python-publish.yml

name: Publish
on:
  release:
    types: [published]

permissions:
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    container: python:3.7-bullseye

    steps:
      - uses: actions/checkout@v4

      - name: Tooling compatible with Py3.7
        run: |
          python -m pip install --upgrade "pip<24"       # pip 24+ dropped 3.7
          python -m pip install "build<1.2"              # build>=1.2 dropped 3.7
          python -m pip install "setuptools<68"          # safe lower bound for 3.7 projects
          python -m pip install "wheel<0.42"             # newer wheel dropped 3.7
          python -m pip install "twine>=4,<5"            # 3.7-compatible twine

      - name: Build sdist & wheel
        run: python -m build

      - name: Publish to PyPI with token
        run: python -m twine upload dist/*
        env:
          TWINE_USERNAME: __token__
          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}