feat: add trufflehog scan for secret leaks and update GitHub Actions #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Python Package to PyPI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| jobs: | |
| publish: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # required for trusted publishing if using PyPI's OIDC | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install Hatch | |
| run: pip install hatch | |
| - name: Build package | |
| run: hatch build | |
| - name: Publish to TestPyPI on develop | |
| if: github.ref == 'refs/heads/develop' | |
| run: hatch publish --no-prompt | |
| env: | |
| HATCH_INDEX_REPO: https://test.pypi.org/legacy/ | |
| HATCH_INDEX_USER: __token__ | |
| HATCH_INDEX_AUTH: ${{ secrets.PYPI_TEST_API_TOKEN }} | |
| - name: Publish to PyPI on main | |
| if: github.ref == 'refs/heads/main' | |
| run: hatch publish --no-prompt | |
| env: | |
| HATCH_INDEX_REPO: https://pypi.org/legacy/ |