diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index de62cfe..6e6ae17 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,5 +1,10 @@
 name: Upload Python Package
 
+# Publishing a GitHub release uploads the package to PyPI. Running this
+# workflow by hand on main uploads it to TestPyPI. Both use PyPI trusted
+# publishing (OIDC), so no API token is stored in this repository; the
+# publish jobs run in the "pypi" / "testpypi" environments.
+
 on:
   release:
     types: [published]
@@ -8,10 +13,74 @@ on:
 permissions: {}
 
 jobs:
-  deploy:
+  build:
+    runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write # trusted signing of build provenance attestations
+      # for the build provenance attestation
+      id-token: write
       attestations: write
-    uses: cpp-linter/.github/.github/workflows/py-publish.yml@main
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # setuptools_scm needs the tags
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.x'
+      - name: Build wheel
+        run: pipx run build --wheel --outdir dist
+      - name: Check distribution
+        run: pipx run twine check dist/*
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist
+
+  publish-testpypi:
+    name: Publish to TestPyPI
+    needs: build
+    if: >-
+      github.event_name == 'workflow_dispatch' &&
+      github.ref == 'refs/heads/main' &&
+      github.repository_owner == 'cpp-linter'
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/cpp-linter-hooks/
+    permissions:
+      id-token: write # trusted publishing
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+
+  publish-pypi:
+    name: Publish to PyPI
+    needs: build
+    if: >-
+      github.event_name == 'release' &&
+      startsWith(github.ref, 'refs/tags/') &&
+      github.repository_owner == 'cpp-linter'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/cpp-linter-hooks/
+    permissions:
+      id-token: write # trusted publishing
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2