Configure PyPI trusted publishing

.github/workflows/ci.yml

@@ -57,3 +57,21 @@ jobs:
 
       - name: lints
         run: ./s/lint
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+
+      - name: build
+        run: uv build
+
+      - name: check metadata
+        run: uvx twine check dist/*

.github/workflows/publish.yml

@@ -0,0 +1,33 @@
+name: Publish
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    # PyPI trusted publishing is scoped to this environment
+    environment: pypi
+    permissions:
+      # required for trusted publishing (OIDC)
+      id-token: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          # avoid restoring a cache into a published artifact
+          enable-cache: false
+
+      - name: Build
+        run: uv build
+
+      - name: Publish
+        run: uv publish

CHANGELOG.md

@@ -7,7 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+# 0.9.0 - 2026-06-28
+
 - Migrate tooling to GitHub Actions, uv, and Ruff, and update the supported Python versions.
+- Publish to PyPI from CI via trusted publishing.
 
 # 0.8.0 - 2025-04-25
 

README.md

@@ -53,10 +53,10 @@ s/lint
 # update CHANGELOG.md
 
 # commit release commit to GitHub
+```
 
-# build and publish
-uv build
-uv publish
+Then create a release in the GitHub UI. The `Publish` workflow builds the
+package and uploads it to PyPI via [trusted publishing][trusted-publishing]
+(OIDC, no API token).
 
-# create a release in the GitHub UI
-```
+[trusted-publishing]: https://docs.pypi.org/trusted-publishers/

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codeowners"
-version = "0.8.0"
+version = "0.9.0"
 description = "Codeowners parser for Python"
 authors = [{ name = "Steve Dignam", email = "steve@dignam.xyz" }]
 readme = "README.md"