From 328465355a982009399f68ef186eefb8708f328a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Semid=C3=A1n=20Robaina=20Est=C3=A9vez?=
 <semidan.robaina@gmail.com>
Date: Fri, 19 Jun 2026 12:35:04 +0100
Subject: [PATCH] Add PyPI Trusted Publishing workflow; bump version to 1.2.0

- .github/workflows/publish.yml: on each published GitHub Release, build the
  sdist+wheel and upload to PyPI via Trusted Publishing (OIDC, no API tokens).
  twine check runs before publishing. The publish job uses the `pypi`
  environment and `id-token: write`.
- Bump version 1.1.2 -> 1.2.0 (first pip-only / conda-free release; v1.1.2 was
  already tagged for the old conda build).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 52 +++++++++++++++++++++++++++++++++++
 pyproject.toml                |  2 +-
 2 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..666e2cb
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,52 @@
+name: publish
+
+# Build and publish Pynteny to PyPI via Trusted Publishing (OIDC) whenever a
+# GitHub Release is published. No API tokens or secrets are stored: PyPI must
+# have a "trusted publisher" configured for this repository, workflow
+# (publish.yml) and environment (pypi).
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+
+  build:
+    name: Build distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist and wheel
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build
+      - name: Check distribution metadata
+        run: |
+          python -m pip install twine
+          twine check dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/pynteny/
+    permissions:
+      id-token: write  # required for Trusted Publishing (OIDC)
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/pyproject.toml b/pyproject.toml
index e225886..c09001b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [tool.poetry]
 name = "pynteny"
-version = "1.1.2"
+version = "1.2.0"
 description = "Synteny-aware hmm searches made easy in Python"
 license = "Apache-2.0"
 authors = ["Semidán Robaina Estévez <srobaina@ull.edu.es>"]