From 0cadcbc5a8736367ef4982a0fcc5277c1c104f63 Mon Sep 17 00:00:00 2001
From: nandgator <38415384+nandgator@users.noreply.github.com>
Date: Sun, 11 Oct 2026 16:18:55 +0530
Subject: [PATCH] ci: publish to PyPI with trusted publishing

---
 .github/workflows/package.yaml     | 59 ++++++++++++++++++++++++++++++
 .github/workflows/package.yaml.bkp | 44 ----------------------
 2 files changed, 59 insertions(+), 44 deletions(-)
 create mode 100644 .github/workflows/package.yaml
 delete mode 100644 .github/workflows/package.yaml.bkp

diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
new file mode 100644
index 0000000..a159e92
--- /dev/null
+++ b/.github/workflows/package.yaml
@@ -0,0 +1,59 @@
+# Publish to PyPI
+#
+# Uses PyPI trusted publishing (OIDC), so no token is stored here. Requires a trusted
+# publisher on PyPI for this repository, workflow `package.yaml` and environment `pypi`.
+# The man page is generated as part of the build, so the sdist matches `package/roll.sh`.
+name: package
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+jobs:
+  build:
+    if: github.repository == 'python-validators/validators'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      # checkout repository (for a release, the tagged commit)
+      - name: Checkout repository
+        uses: actions/checkout@v7
+      # set up uv and a specific python version
+      - name: Set up uv with Python v3.11
+        uses: astral-sh/setup-uv@v10.3.0
+        with:
+          python-version: "3.11"
+      # build package: generates the man page, then runs `uv build`
+      # (`SOURCE_DATE_EPOCH` makes the wheel reproducible)
+      - name: Build package
+        run: |
+          SOURCE_DATE_EPOCH="$(git log -1 --format=%ct)"
+          export SOURCE_DATE_EPOCH
+          uv run --locked --no-editable --group docs-offline --extra crypto-eth-addresses \
+            python package/export pkg
+      - name: Show checksums
+        run: sha256sum dist/*
+      # upload package as artifact
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/validators
+    permissions:
+      id-token: write
+    steps:
+      - name: Download artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: dist
+          path: dist/
+      # publish package
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/.github/workflows/package.yaml.bkp b/.github/workflows/package.yaml.bkp
deleted file mode 100644
index 39ad079..0000000
--- a/.github/workflows/package.yaml.bkp
+++ /dev/null
@@ -1,44 +0,0 @@
-# Publish to PyPI
-name: package
-on:
-  workflow_dispatch:
-  # uncomment the following lines to enable workflow on package release
-  # release:
-  #   types: [published]
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    env:
-      BUILD_PATH: .
-    steps:
-      # checkout repository
-      - name: Checkout repository
-        uses: actions/checkout@v7
-      # set up uv and a specific python version
-      - name: Set up uv with Python v3.11
-        uses: astral-sh/setup-uv@v10.3.0
-        with:
-          python-version: "3.11"
-      # build package (generates the man page, then runs `uv build`)
-      - name: Build package
-        run: |
-          uv run --locked --no-editable --group docs-offline --extra crypto-eth-addresses \
-            python package/export pkg
-      # upload package as artifact
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
-        with:
-          path: ${{ env.BUILD_PATH }}/dist
-  publish:
-    needs: build
-    runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-    steps:
-      # publish package
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}