From e77f3bc309487a4e2d20696fdef33b03e7187986 Mon Sep 17 00:00:00 2001 From: Henry Schreiner Date: Wed, 5 Aug 2026 15:43:35 -0400 Subject: [PATCH 1/3] ci: add cd.yml for trusted publishing Assisted-by: ClaudeCode:claude-opus-5 --- .github/workflows/cd.yml | 50 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 .github/workflows/cd.yml diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml new file mode 100644 index 0000000..d4c5094 --- /dev/null +++ b/.github/workflows/cd.yml @@ -0,0 +1,50 @@ +name: CD + +on: + workflow_dispatch: + release: + types: + - published + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +permissions: {} + +jobs: + dist: + runs-on: ubuntu-latest + name: Build distribution + steps: + - uses: actions/checkout@v7 + with: + fetch-depth: 0 + persist-credentials: false + - uses: hynek/build-and-inspect-python-package@v2.18.0 + + publish: + needs: [dist] + runs-on: ubuntu-latest + name: Publish to PyPI + if: github.event_name == 'release' && github.event.action == 'published' + environment: + name: pypi + url: https://pypi.org/p/pybind11_mkdoc + permissions: + id-token: write # Needed for PyPI trusted publishing and attestations + attestations: write # Needed for artifact attestation + steps: + - uses: actions/download-artifact@v8 + with: + name: Packages + path: dist + + - name: Generate artifact attestation for sdist and wheel + uses: actions/attest-build-provenance@v4.1.1 + with: + subject-path: "dist/*" + + - uses: pypa/gh-action-pypi-publish@v1.14.1 + with: + attestations: true From baa2cb5ac80dba5f9f0c39b918c9fa3d13546fea Mon Sep 17 00:00:00 2001 From: Henry Schreiner Date: Wed, 5 Aug 2026 15:46:45 -0400 Subject: [PATCH 2/3] Apply suggestions from code review Co-authored-by: Henry Schreiner --- .github/workflows/cd.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index d4c5094..45aa2dd 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -19,7 +19,6 @@ jobs: steps: - uses: actions/checkout@v7 with: - fetch-depth: 0 persist-credentials: false - uses: hynek/build-and-inspect-python-package@v2.18.0 @@ -46,5 +45,3 @@ jobs: subject-path: "dist/*" - uses: pypa/gh-action-pypi-publish@v1.14.1 - with: - attestations: true From f1ae06aa1a6aeb3ccf55216d4988aefd350fc3ce Mon Sep 17 00:00:00 2001 From: Henry Schreiner Date: Wed, 5 Aug 2026 21:09:35 -0400 Subject: [PATCH 3/3] ci: bump actions to latest versions Assisted-by: ClaudeCode:claude-opus-5 --- .github/workflows/cd.yml | 4 ++-- .github/workflows/ci.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml index 45aa2dd..84aa29f 100644 --- a/.github/workflows/cd.yml +++ b/.github/workflows/cd.yml @@ -20,7 +20,7 @@ jobs: - uses: actions/checkout@v7 with: persist-credentials: false - - uses: hynek/build-and-inspect-python-package@v2.18.0 + - uses: hynek/build-and-inspect-python-package@v3.0.1 publish: needs: [dist] @@ -44,4 +44,4 @@ jobs: with: subject-path: "dist/*" - - uses: pypa/gh-action-pypi-publish@v1.14.1 + - uses: pypa/gh-action-pypi-publish@v1.14.2 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 415e773..2c12694 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -75,4 +75,4 @@ jobs: name: Build distribution steps: - uses: actions/checkout@v7 - - uses: hynek/build-and-inspect-python-package@v2.18.0 + - uses: hynek/build-and-inspect-python-package@v3.0.1