From 4d1b0fae5a6a65ca8e296a9f68831468b110b7bf Mon Sep 17 00:00:00 2001 From: bardonadam Date: Sat, 7 Feb 2026 12:10:01 +0100 Subject: [PATCH] ci: harden PyPI publish workflow --- .github/workflows/publish.yml | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 5ec033f..dceca3f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -20,10 +20,33 @@ jobs: with: python-version: "3.11" + - name: Verify tag matches package version + run: | + TAG_VERSION="${GITHUB_REF_NAME#v}" + PACKAGE_VERSION="$(python - <<'PY' +import tomllib +with open("pyproject.toml", "rb") as f: + data = tomllib.load(f) +print(data["project"]["version"]) +PY +)" + if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then + echo "Tag version ($TAG_VERSION) does not match package version ($PACKAGE_VERSION)." + exit 1 + fi + - name: Build distributions run: | python -m pip install -U pip build python -m build - - name: Publish to PyPI + - name: Publish to PyPI (API token) + if: ${{ secrets.PYPI_API_TOKEN != '' }} + uses: pypa/gh-action-pypi-publish@release/v1 + with: + user: __token__ + password: ${{ secrets.PYPI_API_TOKEN }} + + - name: Publish to PyPI (trusted publisher) + if: ${{ secrets.PYPI_API_TOKEN == '' }} uses: pypa/gh-action-pypi-publish@release/v1