From 0119dfb5f47f0fc0437addde600b76f3e5db855f Mon Sep 17 00:00:00 2001
From: Adarsh Divakaran <adarsh@serpapi.com>
Date: Wed, 22 Jul 2026 11:03:20 +0530
Subject: [PATCH] feat: add PyPI trusted publishing

---
 .github/workflows/ci.yml      |  4 ++--
 .github/workflows/release.yml | 21 +++++++--------------
 README.md                     |  2 +-
 3 files changed, 10 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2f220fd..e363806 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
 
     steps:
     - name: Checkout repository
@@ -36,7 +36,7 @@ jobs:
         API_KEY: ${{ secrets.API_KEY }}
 
     - name: Run example tests
-      if: matrix.python-version == '3.13'
+      if: matrix.python-version == '3.14'
       run: pytest -k "example"
       env:
         API_KEY: ${{ secrets.API_KEY }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c3c5335..0faced5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
+        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@v6
 
@@ -31,7 +31,7 @@ jobs:
           API_KEY: ${{ secrets.API_KEY }}
 
       - name: Run example tests
-        if: matrix.python-version == '3.13'
+        if: matrix.python-version == '3.14'
         run: pytest -k "example"
         env:
           API_KEY: ${{ secrets.API_KEY }}
@@ -62,19 +62,18 @@ jobs:
     name: Publish release
     needs: [build]
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/serpapi
     permissions:
       contents: write
-      packages: write
+      id-token: write
     steps:
       - uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist/
 
-      - uses: actions/setup-python@v6
-        with:
-          python-version: "3.13"
-
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -83,14 +82,8 @@ jobs:
           gh release create ${{ github.ref_name }} dist/* --generate-notes \
             || gh release upload ${{ github.ref_name }} dist/* --clobber
 
-      - name: Install twine
-        run: pip install --upgrade pip twine
-
       - name: Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-        run: twine upload dist/*
+        uses: pypa/gh-action-pypi-publish@release/v1
 
   smoke-test:
     name: Smoke test published package
diff --git a/README.md b/README.md
index 15eb407..749c080 100644
--- a/README.md
+++ b/README.md
@@ -380,4 +380,4 @@ Bug reports and pull requests are welcome on GitHub. Once dependencies are insta
    ```
    This triggers the [release workflow](.github/workflows/release.yml), which tests, builds, and publishes to PyPI, then smoke-tests the published package.
 
-> **Required secrets:** `PYPI_API_TOKEN` (PyPI upload token) and `API_KEY` (used in smoke-test live search).
+> **Required secret:** `API_KEY` (used in smoke-test live search).