Tighten SSH option passthrough #7

	# This workflow will upload a Python Package using Twine when a release is created
	# For more information see:
	# https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
	# https://docs.pypi.org/trusted-publishers/using-a-publisher/
	# https://docs.astral.sh/uv/guides/publish/

	# This workflow uses actions that are not certified by GitHub.
	# They are provided by a third-party and are governed by
	# separate terms of service, privacy policy, and support
	# documentation.

	name: Upload Python package to PyPI

	on:
	push:
	tags:
	- "v..*"

	permissions:
	contents: read

	jobs:
	release-build:
	runs-on: ubuntu-latest
	environment: release

	steps:
	- uses: actions/checkout@v4

	- name: "Set up Python"
	uses: actions/setup-python@v5
	with:
	python-version-file: "pyproject.toml"

	- name: Install uv
	uses: astral-sh/setup-uv@v3
	with:
	enable-cache: true

	- name: Build package
	run: uv build

	- name: Upload distributions
	uses: actions/upload-artifact@v4
	with:
	name: release-dists
	path: dist/

	pypi-publish:
	name: upload release to PyPI
	runs-on: ubuntu-latest
	needs:
	- release-build
	environment: release
	permissions:
	# IMPORTANT: this permission is mandatory for trusted publishing
	id-token: write

	steps:

	- name: Retrieve release distributions
	uses: actions/download-artifact@v4
	with:
	name: release-dists
	path: dist/

	- name: Publish package
	uses: pypa/gh-action-pypi-publish@release/v1

Provide feedback