pypi-publish.yml

name: Publish package to PyPi

on:
  # CHANGED: This allows you to manually run the workflow from the 
  # GitHub Actions tab (click 'Run workflow').
  workflow_dispatch:
    inputs:
      branch:
        description: 'Branch or tag to build from (e.g., main or v1.0.0)'
        required: true
        default: 'main'

jobs:
  push:
    runs-on: ubuntu-latest

    # 1. SECURITY: Add permissions for OIDC token generation
    permissions:
      id-token: write  # Grants permission to exchange a token with PyPI
      contents: read   # Allows checkout of the repository

    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          # Use the branch/tag provided in the manual input
          ref: ${{ github.event.inputs.branch }}

      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          # Use a stable, specific version
          python-version: 3.11 

      - name: Build package
        # Install the 'build' tool and then run it to create the sdist and wheel.
        run: |
          python -m pip install --upgrade pip
          python -m pip install build
          python -m build

      # 2. SECURITY: Publish to PyPi (using Trusted Publisher)
      - name: Publish to PyPi (using Trusted Publisher)
        uses: pypa/gh-action-pypi-publish@release/v1
        # No manual secrets are needed!