ci: PyPI publish workflow (Trusted Publishing)

[DataDave-Dev]

Adds .github/workflows/publish.yml that publishes to PyPI via OIDC Trusted Publishing when a GitHub Release is published (no API token). Also ignores build/ and dist/.

Requires a one-time PyPI pending-publisher config before the first release.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a GitHub Actions workflow (publish.yml) that triggers on GitHub Release publication, builds the Python package, and publishes it to PyPI using OIDC Trusted Publishing. Also adds build/ and dist/ to .gitignore.

Changes

PyPI Publish Workflow

Layer / File(s)	Summary
Publish workflow and .gitignore .github/workflows/publish.yml, .gitignore	New workflow triggers on release.published, runs on ubuntu-latest with id-token: write, checks out repo, sets up Python 3.12, builds via python -m build, and publishes with pypa/gh-action-pypi-publish. build/ and dist/ added to .gitignore.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐇 Hop, hop, hooray, a workflow's in place,
On each new release, PyPI gets a taste!
With OIDC tokens and a build/ ignored,
The rabbit ships packages — nothing is floored.
dist/ swept away, the burrow stays clean! 🌿

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a PyPI publish workflow using Trusted Publishing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/pypi-publish

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

.github/workflows/publish.yml (2)

13-13: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Disable credential persistence on checkout.

python -m build executes repository-controlled packaging hooks, so leaving the GitHub token in local git config past checkout is unnecessary exposure in this publish job.

Suggested change

-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish.yml at line 13, The checkout step in the publish
workflow currently leaves credentials persisted in local git config, which is
unnecessary for this job. Update the existing actions/checkout usage in the
publish workflow to disable credential persistence by setting the appropriate
checkout option, so the GitHub token is not retained after checkout while
`python -m build` runs packaging hooks.

Source: Linters/SAST tools

---

22-22: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pin the publish action to a commit SHA.

Using a mutable ref for the release publish step means upstream changes can alter your PyPI release behavior without a code change here. For a publishing workflow, pinning this action to a reviewed SHA is safer.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish.yml at line 22, The publish step in the workflow
uses a mutable ref for pypa/gh-action-pypi-publish, so update the publish job to
reference a reviewed commit SHA instead of release/v1. Keep the change localized
to the publish action entry in the workflow and ensure the pinned SHA is the
exact version you intend to trust for PyPI releases.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/publish.yml:
- Line 13: The checkout step in the publish workflow currently leaves
credentials persisted in local git config, which is unnecessary for this job.
Update the existing actions/checkout usage in the publish workflow to disable
credential persistence by setting the appropriate checkout option, so the GitHub
token is not retained after checkout while `python -m build` runs packaging
hooks.
- Line 22: The publish step in the workflow uses a mutable ref for
pypa/gh-action-pypi-publish, so update the publish job to reference a reviewed
commit SHA instead of release/v1. Keep the change localized to the publish
action entry in the workflow and ensure the pinned SHA is the exact version you
intend to trust for PyPI releases.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2f3af848-3895-417c-9262-8693c5fddbf8

📥 Commits

Reviewing files that changed from the base of the PR and between a3ded24 and 03dd23e.

📒 Files selected for processing (2)

• .github/workflows/publish.yml
• .gitignore