From 613961e44c09c194c5aa035a4c59d1f5286bad80 Mon Sep 17 00:00:00 2001
From: MrPredic <269417388+MrPredic@users.noreply.github.com>
Date: Wed, 5 Aug 2026 16:56:42 +0200
Subject: [PATCH] ci: publish to PyPI on tag via Trusted Publishing (OIDC)

The package builds and passes `twine check`, but nothing ever pushed it: the
name is unclaimed on PyPI and the README had to send readers to a git URL.
This adds the tag-triggered release job. It uses OIDC rather than an API
token, so there is no publishing secret in the repo to leak.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VWTgH2xDR5xafCX83YvQQV
---
 .github/workflows/release.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..1f4fbdd
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,24 @@
+name: release
+
+# Publishes to PyPI when a v* tag is pushed. No API token exists anywhere:
+# the job authenticates to PyPI over OIDC (Trusted Publishing), so a leaked
+# repo secret cannot be used to publish, because there is no secret.
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write     # OIDC for PyPI trusted publishing -- no token on disk
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - run: pip install build twine
+      - run: python -m build
+      - run: twine check dist/*
+      - uses: pypa/gh-action-pypi-publish@release/v1