From 3e9c13a1c990427d592862974617e4bde6f997c3 Mon Sep 17 00:00:00 2001
From: Sebastian Castro <sebas.a.castro@gmail.com>
Date: Mon, 14 Sep 2026 20:02:01 -0400
Subject: [PATCH] [infra] Add CI workflow to automatically publish to PyPi

---
 .github/workflows/publish.yaml | 47 ++++++++++++++++++++++++++++++++++
 DEVELOPING.md                  |  7 ++++-
 2 files changed, 53 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/publish.yaml

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
new file mode 100644
index 00000000..9f5f7e14
--- /dev/null
+++ b/.github/workflows/publish.yaml
@@ -0,0 +1,47 @@
+name: publish
+
+on:
+  push:
+    tags:
+      # Bare semantic version tags, e.g. 2.6.0
+      - '[0-9]+.[0-9]+.[0-9]+'
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@v4
+    - name: Install uv
+      uses: astral-sh/setup-uv@v5
+      with:
+        enable-cache: true
+    - name: Check the tag matches the project version
+      run: |
+        version="$(uv version --short)"
+        if [ "${version}" != "${GITHUB_REF_NAME}" ]; then
+          echo "Tag '${GITHUB_REF_NAME}' does not match pyproject.toml version '${version}'" >&2
+          exit 1
+        fi
+    - name: Build sdist and wheel
+      run: uv build
+    - uses: actions/upload-artifact@v4
+      with:
+        name: dist
+        path: dist/
+        if-no-files-found: error
+
+  publish:
+    needs: build
+    runs-on: ubuntu-24.04
+    environment:
+      name: pypi
+      url: https://pypi.org/project/py_trees/${{ github.ref_name }}
+    permissions:
+      id-token: write  # required for PyPI trusted publishing
+    steps:
+    - uses: actions/download-artifact@v4
+      with:
+        name: dist
+        path: dist/
+    - name: Publish to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/DEVELOPING.md b/DEVELOPING.md
index 5acc2120..aeefe8c8 100644
--- a/DEVELOPING.md
+++ b/DEVELOPING.md
@@ -62,6 +62,11 @@ $ uv export --no-hashes --no-emit-project --no-default-groups --group docs -o do
 # Build the sdist & wheel into ./dist
 $ uv build
 
-# Publish to PyPI (requires credentials, e.g. UV_PUBLISH_TOKEN)
+# Publish to PyPI manually (requires credentials, e.g. UV_PUBLISH_TOKEN)
 $ uv publish
 ```
+
+Releases are normally published by CI instead: pushing a tag of the form `x.y.z`
+(e.g. `2.6.0`) runs `.github/workflows/publish.yaml`, which checks that the tag
+matches the version in `pyproject.toml`, builds the distributions and uploads them
+to PyPI via trusted publishing (no token needed).