python-publish.yml

# This workflow will upload a Python Package using Twine when a release is created
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: Upload Python Package

on:
  workflow_dispatch:
  #push:
#    branches: [ "main" ]
 # pull_request:
 #   branches: [ "main" ]
 # schedule:
#   - cron: '26 16 * * 5'

permissions:
  contents: read

jobs:
  deploy:

    runs-on: ubuntu-latest

    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
      with:
        disable-sudo: true
        egress-policy: block
        allowed-endpoints: >
          files.pythonhosted.org:443
          github.com:443
          pypi.org:443
          upload.pypi.org:443

    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
    - name: Set up Python
      uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
      with:
        python-version: '3.11'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install build==1.2.1
    - name: Build package
      run: python -m build
    - name: Publish package
      uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450
      with:
        user: __token__
        password: ${{ secrets.PYPI_API_TOKEN }}