From 0a4d45aea168cb88c15d691bbee70c5c42852a55 Mon Sep 17 00:00:00 2001
From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>
Date: Thu, 22 Oct 2026 18:14:58 +0000
Subject: [PATCH 1/2] chore: publish to PyPI with trusted publishing

Publishing used long-lived PyPI and TestPyPI API tokens, passed with
'secrets: inherit' to a shared workflow on cpp-linter/.github@main.
Build and publish in this repository instead, with OIDC trusted
publishing from the 'pypi' and 'testpypi' environments, so no PyPI
token needs to be stored. Releases still go to PyPI and manual runs on
main still go to TestPyPI.
---
 .github/workflows/publish.yml | 79 +++++++++++++++++++++++++++++++++--
 1 file changed, 75 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index de62cfe..ffd4c86 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,5 +1,10 @@
 name: Upload Python Package
 
+# Publishing a GitHub release uploads the package to PyPI. Running this
+# workflow by hand on main uploads it to TestPyPI. Both use PyPI trusted
+# publishing (OIDC), so no API token is stored in this repository; the
+# publish jobs run in the "pypi" / "testpypi" environments.
+
 on:
   release:
     types: [published]
@@ -8,10 +13,76 @@ on:
 permissions: {}
 
 jobs:
-  deploy:
+  build:
+    runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write # trusted signing of build provenance attestations
+      # for the build provenance attestation
+      id-token: write
       attestations: write
-    uses: cpp-linter/.github/.github/workflows/py-publish.yml@main
-    secrets: inherit
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # setuptools_scm needs the tags
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.x'
+      - name: Build wheel
+        run: |
+          python -m pip install --upgrade pip twine
+          python -m pip wheel -w dist --no-deps .
+      - name: Check distribution
+        run: twine check dist/*
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist
+
+  publish-testpypi:
+    name: Publish to TestPyPI
+    needs: build
+    if: >-
+      github.event_name == 'workflow_dispatch' &&
+      github.ref == 'refs/heads/main' &&
+      github.repository_owner == 'cpp-linter'
+    runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/cpp-linter-hooks/
+    permissions:
+      id-token: write # trusted publishing
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
+
+  publish-pypi:
+    name: Publish to PyPI
+    needs: build
+    if: >-
+      github.event_name == 'release' &&
+      startsWith(github.ref, 'refs/tags/') &&
+      github.repository_owner == 'cpp-linter'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/cpp-linter-hooks/
+    permissions:
+      id-token: write # trusted publishing
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

From d6e36b1d0104fd4370133d7b4d1634f019894e5d Mon Sep 17 00:00:00 2001
From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>
Date: Thu, 22 Oct 2026 18:24:16 +0000
Subject: [PATCH 2/2] chore: build the wheel with pipx run build

---
 .github/workflows/publish.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ffd4c86..6e6ae17 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -30,11 +30,9 @@ jobs:
         with:
           python-version: '3.x'
       - name: Build wheel
-        run: |
-          python -m pip install --upgrade pip twine
-          python -m pip wheel -w dist --no-deps .
+        run: pipx run build --wheel --outdir dist
       - name: Check distribution
-        run: twine check dist/*
+        run: pipx run twine check dist/*
       - name: Attest build provenance
         uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with: