From 6ff51bfa2f7cf547eaa00452a4ced84ba4db1c84 Mon Sep 17 00:00:00 2001
From: Abhinaysai Kamineni <66816045+askmy-stack@users.noreply.github.com>
Date: Wed, 12 Aug 2026 17:14:57 -0400
Subject: [PATCH] restore protected PyPI publishing

---
 .github/workflows/publish.yml | 1 +
 docs/publishing.md            | 7 ++-----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8bdf732..a4d08a5 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,6 +12,7 @@ permissions:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-python@v7
diff --git a/docs/publishing.md b/docs/publishing.md
index 9afd191..f3752a0 100644
--- a/docs/publishing.md
+++ b/docs/publishing.md
@@ -11,11 +11,8 @@ No long-lived PyPI API token is stored in the repository.
    - Owner: `askmy-stack`
    - Repository: `tool-semantics`
    - Workflow: `publish.yml`
-   - Environment: leave blank
-
-The workflow intentionally has no GitHub Environment. If an environment is added
-later, add the same environment name to PyPI's trusted-publisher configuration
-first; otherwise PyPI will reject the environment-scoped OIDC identity.
+   - Environment: `pypi`
+3. In GitHub, create an Environment named `pypi` (optional protection rules).
 
 ## Release steps