📡 PyPI

Publishing your package to PyPI is handled by .github/workflows/pypi-publish.yml, which combines automated release management with Trusted Publishing — no API tokens required.

How Releases Work

1. Push commits to main with Conventional Commits messages (feat:, fix:, ...).
2. python-semantic-release determines the next version, updates pyproject.toml and CHANGELOG.md, and creates a v*.*.* tag.
3. The tag triggers the publish workflow, which builds the package, generates PEP 740 attestations, and uploads it to PyPI via Trusted Publishing. A GitHub Release with the built artifacts is created automatically.

One-Time Setup: Trusted Publishing

1. On PyPI, open your project and go to Publishing.
2. Click Add a new trusted publisher and fill in:
3. Workflow name: pypi-publish.yml
4. Environment: pypi
5. Repository: <owner>/<repository>
6. Done — no PYPI_TOKEN secret needed. OIDC handles authentication.

[!note] If you prefer an API token instead, set the PYPI_TOKEN secret and it will be used as a fallback by uv publish.

PyPI Testing

PyPI has a test package publishing index for you to work through any kinks before you go live. Point the publish job at it with:

uv publish --publish-url https://test.pypi.org/legacy/

References

• PyPI
• Trusted Publishing
• PyPI Testing
• python-semantic-release
• GitHub Actions Guide