From 3071859785441653938501c53f3630e56b66147b Mon Sep 17 00:00:00 2001
From: Mladen Milankovic <developer@mmlado.com>
Date: Thu, 29 Oct 2026 17:55:20 +0100
Subject: [PATCH] Add PyPI publish workflow via trusted publishing

A push of a tag matching ver* builds the sdist and wheel and uploads
them to PyPI from the pypi environment. Before the upload the workflow
checks that the tagged commit is on main and that the tag equals ver
plus cryptnox_cli.__version__.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 59 +++++++++++++++++++++++++++++++++++
 CHANGELOG.rst                 |  1 +
 2 files changed, 60 insertions(+)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..a119ecb
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,59 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags: ["ver*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Check tag is on main
+        run: |
+          if ! git merge-base --is-ancestor HEAD origin/main; then
+            echo "Tag ${GITHUB_REF_NAME} does not point to a commit on main - not publishing" >&2
+            exit 1
+          fi
+
+      - name: Check tag matches package version
+        run: |
+          version=$(sed -n 's/^__version__ = "\(.*\)"$/\1/p' cryptnox_cli/__init__.py)
+          if [ "${GITHUB_REF_NAME}" != "ver${version}" ]; then
+            echo "Tag ${GITHUB_REF_NAME} does not match cryptnox_cli.__version__ ${version}" >&2
+            exit 1
+          fi
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.13"
+
+      - run: pip install build
+      - run: python -m build
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
+        with:
+          name: dist
+          path: dist/*
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/cryptnox-cli
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333  # v8.0.2
+        with:
+          name: dist
+          path: dist
+
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086  # v1.14.3
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index ee4537e..4c81406 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -14,6 +14,7 @@ Added
 - CI runs flake8, pylint and the dependency license check on Python 3.14
 - Dependabot opens update pull requests for the GitHub Actions every week and for the Python dependencies every month; minor and patch updates come grouped in one pull request per ecosystem, major updates one by one, and a release is proposed once it is seven days old
 - ``NOTICES.md`` and the license texts of code from other projects are included in the package; the Windows installer installs them together with the licenses of the bundled Python packages
+- A release tag such as ``ver1.1.0`` pushed to the repository builds the package and publishes it to PyPI from CI; the tag has to point to a commit on ``main`` and match the package version
 
 Changed
 ^^^^^^^