update publish workflow

Author: cyclotruc

.github/workflows/publish.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch: # Allows manual triggering of the workflow
 
 jobs:
-  publish:
+  release-build:
     runs-on: ubuntu-latest
 
     steps:
@@ -18,62 +18,79 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: 3.13
+          python-version: "3.13"
 
-      # Step 3: Install dependencies for building and publishing
-      - name: Install build tools
+      # Verify version matches the release tag
+      - name: Verify version
+        if: github.event_name == 'release'
         run: |
-          pip install --upgrade pip
-          pip install build twine
+          PROJECT_VERSION=$(grep "^version = " pyproject.toml | cut -d'"' -f2)
+          TAG_VERSION=${GITHUB_REF#refs/tags/}
+          TAG_VERSION=${TAG_VERSION#v}
+
+          if [ "$PROJECT_VERSION" != "$TAG_VERSION" ]; then
+            echo "Version mismatch: pyproject.toml version ($PROJECT_VERSION) doesn't match release tag ($TAG_VERSION)"
+            exit 1
+          fi
 
-      # Step 4: Build the package
-      - name: Build the package
+      # Step 3: Build the package
+      - name: Build release distributions
         run: |
+          python -m pip install --upgrade pip
+          python -m pip install build
           python -m build
 
-      # Step 5: Verify the built package
+      # Step 4: Verify the built package
       - name: Verify package
         run: |
+          python -m pip install twine
           if [ ! -f "dist/*.whl" ] || [ ! -f "dist/*.tar.gz" ]; then
             echo "Expected wheel and source distribution files not found in dist/"
             exit 1
           fi
           python -m twine check dist/*
 
-      # Step 6: Verify version matches the release tag
-      - name: Verify version
-        if: github.event_name == 'release'
-        run: |
-          # Extract version from pyproject.toml
-          PROJECT_VERSION=$(grep "^version = " pyproject.toml | cut -d'"' -f2)
-          # Remove 'v' prefix from tag if present
-          TAG_VERSION=${GITHUB_REF#refs/tags/}
-          TAG_VERSION=${TAG_VERSION#v}
+      # Step 5: Upload release artifacts
+      - name: Upload release artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-dists
+          path: dist/
 
-          if [ "$PROJECT_VERSION" != "$TAG_VERSION" ]; then
-            echo "Version mismatch: pyproject.toml version ($PROJECT_VERSION) doesn't match release tag ($TAG_VERSION)"
-            exit 1
-          fi
+  pypi-publish:
+    runs-on: ubuntu-latest
+    needs: [release-build]
+    environment: pypi
+    permissions:
+      id-token: write  # Required for PyPI trusted publishing
 
-      # Step 7: Publish to PyPI
-      - name: Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
-        run: |
-          python -m twine upload --skip-existing dist/*
+    steps:
+      # Step 1: Retrieve release distributions
+      - name: Retrieve release distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: release-dists
+          path: dist/
+
+      # Step 2: Publish to PyPI using OIDC
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          verbose: true
+          print-hash: true
 
-      # Step 8: Verify package is available on PyPI
+      # Step 3: Verify package is available on PyPI
       - name: Verify PyPI upload
         run: |
           # Wait a bit for PyPI to process the upload
           sleep 30
 
-          # Extract package name from pyproject.toml
-          PACKAGE_NAME=$(grep "^name = " pyproject.toml | cut -d'"' -f2)
+          # Extract package name from the wheel file (assuming it exists)
+          WHEEL_FILE=$(ls dist/*.whl | head -n 1)
+          PACKAGE_NAME=$(basename "$WHEEL_FILE" | cut -d'-' -f1)
+          PACKAGE_VERSION=$(basename "$WHEEL_FILE" | cut -d'-' -f2)
 
-          # Check if package exists on PyPI
-          if ! pip install $PACKAGE_NAME==`python setup.py --version` --no-deps --dry-run; then
+          if ! pip install $PACKAGE_NAME==$PACKAGE_VERSION --no-deps --dry-run; then
             echo "Failed to verify package on PyPI"
             exit 1
           fi