Release to PyPI using Trusted Publishing #1

	name: Release

	on:
	push:
	branches: [main]
	tags: ["*"]
	pull_request:
	branches: [main]
	release:
	types:
	- published
	workflow_dispatch:

	permissions:
	contents: read

	env:
	FORCE_COLOR: 1

	jobs:
	# Always build & lint package.
	build-package:
	name: Build & verify package
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- uses: hynek/build-and-inspect-python-package@v2

	# Upload to Test PyPI on every commit on main.
	release-test-pypi:
	name: Publish in-dev package to test.pypi.org
	if: \|
	github.repository_owner == 'python-humanize'
	&& github.event_name == 'push'
	&& github.ref == 'refs/heads/main'
	runs-on: ubuntu-latest
	needs: build-package

	permissions:
	id-token: write

	steps:
	- name: Download packages built by build-and-inspect-python-package
	uses: actions/download-artifact@v4
	with:
	name: Packages
	path: dist

	- name: Upload package to Test PyPI
	uses: pypa/gh-action-pypi-publish@release/v1
	with:
	attestations: true
	repository-url: https://test.pypi.org/legacy/

	# Upload to real PyPI on GitHub Releases.
	release-pypi:
	name: Publish released package to pypi.org
	if: \|
	github.repository_owner == 'python-humanize'
	&& github.event.action == 'published'
	runs-on: ubuntu-latest
	needs: build-package

	permissions:
	id-token: write

	steps:
	- name: Download packages built by build-and-inspect-python-package
	uses: actions/download-artifact@v4
	with:
	name: Packages
	path: dist

	- name: Upload package to PyPI
	uses: pypa/gh-action-pypi-publish@release/v1
	with:
	attestations: true

Provide feedback