publish.yml

name: Publish Python Package

on:
  release:
    types: [published]
  push:
    tags:
      - 'v*.*.*'
  workflow_dispatch:

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
    
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'
    
    - name: Install build dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build twine
    
    - name: Build package
      run: python -m build
    
    - name: Check package
      run: twine check dist/*
    
    - name: Publish to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1
      with:
        skip-existing: true
        # Option 1: Use trusted publishing (recommended - no token needed)
        # Configure at: https://pypi.org/manage/account/publishing/
        
        # Option 2: Use API token (uncomment if using token instead)
        # password: ${{ secrets.PYPI_API_TOKEN }}