From 75106735f458cc6797672d96b0ce41148fe3d882 Mon Sep 17 00:00:00 2001
From: Spencer Qian <spencer@sonilo.com>
Date: Thu, 9 Jul 2026 22:56:10 -0700
Subject: [PATCH 1/2] ci: publish via PyPI Trusted Publishing (OIDC), drop
 PYPI_TOKEN

---
 .github/workflows/publish.yml | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b902d38..c4b3ae2 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,15 +8,30 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # PyPI Trusted Publishing (OIDC). No PYPI_TOKEN secret needed.
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - run: pip install -e ".[dev]" build twine
+      - run: pip install -e ".[dev]" build
       - run: pytest
+      - name: Verify tag matches pyproject version
+        if: github.ref_type == 'tag'
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          PKG_VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          if [ "$TAG_VERSION" != "$PKG_VERSION" ]; then
+            echo "Tag version ($TAG_VERSION) does not match pyproject version ($PKG_VERSION)"
+            exit 1
+          fi
       - run: python -m build
-      - run: twine upload dist/*
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+      - name: Publish to PyPI
+        # Authenticates via OIDC Trusted Publishing — configured as a pending
+        # publisher for project `sonilo` (repo sonilo-python, workflow publish.yml).
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

From 2d649f4a2fd7d5dd52d4572aab71602550c0cc26 Mon Sep 17 00:00:00 2001
From: Spencer Qian <spencer@sonilo.com>
Date: Thu, 9 Jul 2026 23:03:14 -0700
Subject: [PATCH 2/2] ci: only publish from tag refs

---
 .github/workflows/publish.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c4b3ae2..f5017e0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -32,6 +32,10 @@ jobs:
       - name: Publish to PyPI
         # Authenticates via OIDC Trusted Publishing — configured as a pending
         # publisher for project `sonilo` (repo sonilo-python, workflow publish.yml).
+        # Tag refs only: a workflow_dispatch on a branch runs tests/build but
+        # never publishes. To retry a failed publish, dispatch on the tag:
+        # gh workflow run publish.yml --ref vX.Y.Z
+        if: github.ref_type == 'tag'
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           skip-existing: true