v0.1.3 — pip install inboxsweeper #4

	name: Publish to PyPI

	# Fires when a GitHub release is published, so the tag, the release notes and
	# the PyPI version are always the same event.
	on:
	release:
	types: [published]
	workflow_dispatch:

	permissions: {}

	jobs:
	build:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: '3.12'
	- run: pip install build
	- run: python -m build
	- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: dist
	path: dist/

	publish:
	needs: build
	runs-on: ubuntu-latest
	environment: pypi
	permissions:
	id-token: write # OIDC — this IS the credential. No API token anywhere.
	steps:
	- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: dist
	path: dist/
	# Trusted Publishing: PyPI verifies the workflow's OIDC identity against
	# the publisher configured on the project. Nothing to store or rotate,
	# and a leaked repo secret can't be used to push a release.
	- uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
	with:
	# PyPI versions are immutable, so a re-run (or a release event for a
	# version already dispatched by hand) would otherwise fail the job.
	skip-existing: true

Navigation Menu