v2026.5.23 #1

	name: publish

	# Builds the package and uploads it to PyPI when a GitHub release is
	# published. Requires `PYPI_API_TOKEN` to be set as a repo secret
	# (Settings → Secrets and variables → Actions). Use a project-scoped
	# PyPI API token, never a user-scoped one.

	on:
	release:
	types: [published]
	workflow_dispatch:

	jobs:
	publish:
	runs-on: ubuntu-latest
	permissions:
	# `pypa/gh-action-pypi-publish` supports OIDC trusted publishing
	# in addition to API tokens — `id-token: write` enables that
	# without changing the action invocation below. Falls back to
	# PYPI_API_TOKEN when trusted publishing isn't configured.
	id-token: write
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'

	- name: Install build backend
	run: \|
	python -m pip install --upgrade pip
	pip install build

	- name: Build sdist + wheel
	run: python -m build

	- name: Publish to PyPI
	uses: pypa/gh-action-pypi-publish@release/v1
	with:
	password: ${{ secrets.PYPI_API_TOKEN }}

Provide feedback