aiorainpoint 0.1.0__tar.gz

aiorainpoint-0.1.0/.gitattributes

@@ -0,0 +1,2 @@
+*.crt -text
+*.json -text

aiorainpoint-0.1.0/.github/dependabot.yml

@@ -0,0 +1,44 @@
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Monitor GitHub Actions if you add workflows
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # Hold new releases a few days so a hijacked publish is pulled before it is
+    # proposed. Security updates bypass this.
+    cooldown:
+      default-days: 5
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "ci"
+    labels:
+      - "dependencies"
+      - "github-actions"
+
+  # Monitor Python (pip) dependencies
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 5
+      semver-major-days: 14
+    # One PR for minor and patch bumps; majors still arrive one PR each.
+    groups:
+      pip:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    commit-message:
+      prefix: "chore"
+    labels:
+      - "dependencies"
+      - "python"

aiorainpoint-0.1.0/.github/rulesets/main.json

@@ -0,0 +1,64 @@
+{
+  "name": "main",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": [
+        "~DEFAULT_BRANCH"
+      ],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": false
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": false,
+        "required_status_checks": [
+          {
+            "context": "ruff",
+            "integration_id": 15368
+          },
+          {
+            "context": "mypy",
+            "integration_id": 15368
+          },
+          {
+            "context": "test",
+            "integration_id": 15368
+          },
+          {
+            "context": "test-min",
+            "integration_id": 15368
+          },
+          {
+            "context": "wheel",
+            "integration_id": 15368
+          },
+          {
+            "context": "ha-constraints-min",
+            "integration_id": 15368
+          }
+        ]
+      }
+    }
+  ]
+}

aiorainpoint-0.1.0/.github/workflows/catalog-freshness.yml

@@ -0,0 +1,204 @@
+name: Catalog Freshness
+
+# Writes are done with a GitHub App token rather than GITHUB_TOKEN. A branch
+# pushed with GITHUB_TOKEN does not raise workflow events, so the PR this job
+# opens would sit with no checks on it forever. An App-authored push raises
+# them normally, so the catalog PR gets the same checks as a hand-pushed one.
+# The App and its two secrets are the shared release bot's.
+permissions:
+  contents: read
+
+on:
+  schedule:
+    # An hour after ha-rainpoint's run, which uses the same RainPoint account.
+    - cron: "0 7 * * 1"
+  workflow_dispatch:
+
+# A manual dispatch that overlaps the weekly cron would otherwise race two
+# runs into the same branch and the same PR-creation probe.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+env:
+  BRANCH: automated/product-catalog-sync
+
+jobs:
+  freshness-check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ secrets.RELEASE_PLEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_PLEASE_APP_PRIVATE_KEY }}
+          # Scoped to exactly what the push and the PR need. Requesting a
+          # permission the installation lacks fails the token request, so a run
+          # that starts erroring here wants the specific scope added back rather
+          # than this block removed.
+          permission-contents: write
+          permission-pull-requests: write
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Pinned to main rather than left to default, because a dispatch run
+          # takes the ref picked under "Use workflow from". Off main, the branch
+          # the PR step creates would be based on that ref, so the catalog PR
+          # would carry its unrelated commits while claiming to be a snapshot
+          # refresh. The scheduled run is already on main; this makes the
+          # dispatch behave the same.
+          ref: main
+          # Persisted on purpose, unlike the other workflows here: the drift
+          # step pushes with it.
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Set up Python 3.13
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        with:
+          enable-cache: false
+
+      - name: Install dependencies
+        run: uv pip install --system .
+
+      - name: Check RainPoint credentials are present
+        id: creds
+        env:
+          RAINPOINT_EMAIL: ${{ secrets.RAINPOINT_EMAIL }}
+          RAINPOINT_PASSWORD: ${{ secrets.RAINPOINT_PASSWORD }}
+        run: |
+          if [ -z "$RAINPOINT_EMAIL" ] || [ -z "$RAINPOINT_PASSWORD" ]; then
+            echo "::warning::RainPoint credentials are not set; the catalog was not checked."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      # RAINPOINT_AREA_CODE is a repository variable, not a secret. It is a phone
+      # dial code (1 for the US), which is not sensitive, and holding it as a secret
+      # made the runner redact every occurrence of that digit in the log: the drift
+      # report came back reading "Fetched ***04 model entries" and listing models as
+      # "HTV2***3FRF", which is ambiguous and defeats the point of the report. An
+      # unset variable is an empty string, and the script already falls back to 1.
+      - name: Run catalog freshness check
+        id: check
+        if: steps.creds.outputs.skip == 'false'
+        env:
+          RAINPOINT_EMAIL: ${{ secrets.RAINPOINT_EMAIL }}
+          RAINPOINT_PASSWORD: ${{ secrets.RAINPOINT_PASSWORD }}
+          RAINPOINT_AREA_CODE: ${{ vars.RAINPOINT_AREA_CODE }}
+        run: |
+          # The default step shell is "bash -e", so drift (a deliberate exit 1)
+          # would abort the step before the status could be read. -e goes off
+          # around the call and back on straight after.
+          set +e
+          # --check writes its drift summary to stdout and its progress lines to
+          # stderr, so redirecting stdout alone captures the summary cleanly. It
+          # is worth capturing rather than leaving in the log: it splits changed
+          # models into datapoint changes and metadata-only changes, which is the
+          # difference between "commit this" and "read this carefully", and that
+          # split is what the PR body is for.
+          python scripts/refresh_product_catalog.py --check > drift.txt
+          status=$?
+          set -e
+          cat drift.txt
+          if [ "$status" -eq 0 ]; then
+            echo "drift=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          # Exit 3 is the server's rate limiter refusing every login attempt,
+          # after the script has already waited out the cooldown and retried.
+          # It says nothing about the snapshot, so it must not be reported as
+          # drift and must not reach the regenerate step. Left red rather than
+          # silently green, so a week with no check is visible, but named so
+          # nobody has to read the log to find out why.
+          if [ "$status" -eq 3 ]; then
+            echo "::error::RainPoint rate-limited every login attempt; the catalog was not checked. Re-run this workflow later."
+            exit 1
+          fi
+          # --check also exits 1 when the live pull comes back empty, which is a
+          # fetch failure rather than drift. It reports that on stderr, leaving
+          # stdout empty, so an empty summary here is the failure case and has to
+          # stay a red run.
+          if ! grep -q '[^[:space:]]' drift.txt; then
+            echo "::error::Catalog check failed without producing a drift summary."
+            exit 1
+          fi
+          echo "drift=true" >> "$GITHUB_OUTPUT"
+
+      # The write is a second live pull rather than a reuse of the one above
+      # because write mode is where the guards live: it refuses to overwrite the
+      # committed catalog with an empty pull, or with one holding under half the
+      # models. Fetching twice costs a login and about half a megabyte, once a
+      # week.
+      - name: Regenerate catalog
+        if: steps.check.outputs.drift == 'true'
+        env:
+          RAINPOINT_EMAIL: ${{ secrets.RAINPOINT_EMAIL }}
+          RAINPOINT_PASSWORD: ${{ secrets.RAINPOINT_PASSWORD }}
+          RAINPOINT_AREA_CODE: ${{ vars.RAINPOINT_AREA_CODE }}
+        run: python scripts/refresh_product_catalog.py
+
+      - name: Open or update the catalog PR
+        if: steps.check.outputs.drift == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
+          CATALOG: src/aiorainpoint/data/product_catalog.json
+        run: |
+          set -euo pipefail
+          # The drift report and the written file are two separate pulls, so a
+          # report with nothing behind it is possible and must not become an
+          # empty commit.
+          if git diff --quiet -- "$CATALOG"; then
+            echo "Drift was reported but the regenerated catalog is unchanged; nothing to open."
+            exit 0
+          fi
+          git config user.name "${APP_SLUG}[bot]"
+          git config user.email "${APP_SLUG}[bot]@users.noreply.github.com"
+          # -C resets the branch onto main every run (the checkout is pinned to
+          # it), so it carries exactly one commit and never accumulates stale
+          # ones.
+          git switch -C "$BRANCH"
+          git add "$CATALOG"
+          git commit -m "fix(catalog): refresh the product catalog snapshot"
+          # The checkout is single-branch, so nothing here has a remote-tracking
+          # ref for this branch, and a bare --force-with-lease refuses with
+          # "stale info" from the second push onwards. Fetching the branch is
+          # necessary but not sufficient: the bare form still refuses, because it
+          # wants a value it observed rather than one it just created. Stating
+          # the expected value explicitly is the documented, non-experimental
+          # form of the lease, and it still refuses if anyone else moved the
+          # branch. An absent branch leaves the expectation empty, which git
+          # reads as "must not exist yet", so the first run is covered too.
+          git fetch --no-tags origin "+refs/heads/${BRANCH}:refs/remotes/origin/${BRANCH}" 2>/dev/null || true
+          expected="$(git rev-parse --verify --quiet "refs/remotes/origin/${BRANCH}" || true)"
+          git push --force-with-lease="refs/heads/${BRANCH}:${expected}" origin "$BRANCH"
+
+          {
+            echo "The bundled snapshot of RainPoint's product list no longer matches a live pull, so it has been regenerated."
+            echo
+            echo '```'
+            cat drift.txt
+            echo '```'
+          } > pr-body.md
+
+          number="$(gh pr list --head "$BRANCH" --state open --json number --jq '.[].number')"
+          if [ -z "$number" ]; then
+            gh pr create --draft --base main --head "$BRANCH" \
+              --title "fix(catalog): refresh the product catalog snapshot" \
+              --body-file pr-body.md
+          else
+            # gh pr edit --body fails on the maintainer's repos with a Projects-classic
+            # GraphQL error and changes nothing, so the body is patched through
+            # the REST API instead.
+            gh api -X PATCH "repos/${GITHUB_REPOSITORY}/pulls/${number}" -F body=@pr-body.md > /dev/null
+            echo "PR #${number} for $BRANCH already open; force-push and body update applied."
+          fi

aiorainpoint-0.1.0/.github/workflows/constraints.yml

@@ -0,0 +1,186 @@
+name: HA Constraints
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 8 * * 1"
+
+# Cancel a superseded pull request run. Every other run gets its own group,
+# since a pending run in a shared group is replaced by the next one queued.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+# Checks that the built wheel installs under Home Assistant's pinned dependencies,
+# so a release here cannot make the integration uninstallable.
+jobs:
+  # Required check.
+  ha-constraints-min:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      # The oldest Home Assistant ha-rainpoint supports (its hacs.json minimum); moves when that does.
+      HA_REF: "2026.2.0"
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python 3.13
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        with:
+          enable-cache: false
+
+      - name: Build the wheel
+        run: uv build --wheel
+
+      - name: Fetch Home Assistant's package constraints
+        run: |
+          url="https://raw.githubusercontent.com/home-assistant/core/${HA_REF}/homeassistant/package_constraints.txt"
+          if ! curl -fsSL --retry 3 --retry-delay 2 --retry-all-errors --max-time 30 "$url" -o package_constraints.txt; then
+            echo "::error::Could not download package_constraints.txt for Home Assistant ${HA_REF}"
+            exit 1
+          fi
+          if [ ! -s package_constraints.txt ]; then
+            echo "::error::package_constraints.txt for Home Assistant ${HA_REF} is empty"
+            exit 1
+          fi
+
+      # Home Assistant's own install flags, minus --quiet because the output is read below,
+      # plus --dry-run. A venv because uv refuses a bare interpreter.
+      - name: Resolve the wheel under those constraints
+        run: |
+          uv venv "$RUNNER_TEMP/resolve" --python 3.13
+          status=0
+          uv pip install --dry-run --python "$RUNNER_TEMP/resolve/bin/python" \
+            --index-strategy unsafe-first-match --upgrade \
+            --constraint package_constraints.txt dist/*.whl > resolve.txt 2>&1 || status=$?
+          cat resolve.txt
+          if [ "$status" -ne 0 ]; then
+            echo "::error::The wheel does not resolve under Home Assistant ${HA_REF} constraints"
+            exit 1
+          fi
+
+      - name: Check the resolved pins match Home Assistant's
+        run: |
+          for pkg in aiohttp paho-mqtt; do
+            pin=$(grep -m1 -iE "^${pkg}==" package_constraints.txt || true)
+            if [ -z "$pin" ]; then
+              echo "::error::Home Assistant ${HA_REF} no longer pins $pkg"
+              exit 1
+            fi
+            if ! grep -qxF " + $pin" resolve.txt; then
+              echo "::error::$pkg did not resolve to $pin, the pin in Home Assistant ${HA_REF}"
+              exit 1
+            fi
+          done
+
+  # Not a required check: dev moves daily.
+  ha-constraints-dev:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      HA_REF: dev
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python 3.14
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.14"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        with:
+          enable-cache: false
+
+      - name: Build the wheel
+        run: uv build --wheel
+
+      - name: Fetch Home Assistant's package constraints
+        run: |
+          url="https://raw.githubusercontent.com/home-assistant/core/${HA_REF}/homeassistant/package_constraints.txt"
+          if ! curl -fsSL --retry 3 --retry-delay 2 --retry-all-errors --max-time 30 "$url" -o package_constraints.txt; then
+            echo "::error::Could not download package_constraints.txt for Home Assistant ${HA_REF}"
+            exit 1
+          fi
+          if [ ! -s package_constraints.txt ]; then
+            echo "::error::package_constraints.txt for Home Assistant ${HA_REF} is empty"
+            exit 1
+          fi
+
+      # Home Assistant's own install flags, minus --quiet because the output is read below,
+      # plus --dry-run. A venv because uv refuses a bare interpreter.
+      - name: Resolve the wheel under those constraints
+        run: |
+          uv venv "$RUNNER_TEMP/resolve" --python 3.14
+          status=0
+          uv pip install --dry-run --python "$RUNNER_TEMP/resolve/bin/python" \
+            --index-strategy unsafe-first-match --upgrade \
+            --constraint package_constraints.txt dist/*.whl > resolve.txt 2>&1 || status=$?
+          cat resolve.txt
+          if [ "$status" -ne 0 ]; then
+            echo "::error::The wheel does not resolve under Home Assistant ${HA_REF} constraints"
+            exit 1
+          fi
+
+      - name: Check the resolved pins match Home Assistant's
+        run: |
+          for pkg in aiohttp paho-mqtt; do
+            pin=$(grep -m1 -iE "^${pkg}==" package_constraints.txt || true)
+            if [ -z "$pin" ]; then
+              echo "::error::Home Assistant ${HA_REF} no longer pins $pkg"
+              exit 1
+            fi
+            if ! grep -qxF " + $pin" resolve.txt; then
+              echo "::error::$pkg did not resolve to $pin, the pin in Home Assistant ${HA_REF}"
+              exit 1
+            fi
+          done
+
+  # The only job with a write token. It runs on the schedule alone and checks out nothing.
+  report-scheduled-failure:
+    needs: [ha-constraints-min, ha-constraints-dev]
+    if: ${{ !cancelled() && github.event_name == 'schedule' && contains(needs.*.result, 'failure') }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      issues: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      GH_REPO: ${{ github.repository }}
+      RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      MIN_RESULT: ${{ needs.ha-constraints-min.result }}
+      DEV_RESULT: ${{ needs.ha-constraints-dev.result }}
+
+    steps:
+      - name: Open or update the failure issue
+        run: |
+          title="Weekly Home Assistant constraints check failing"
+          targets=""
+          [ "$MIN_RESULT" = "failure" ] && targets="ha-constraints-min"
+          [ "$DEV_RESULT" = "failure" ] && targets="${targets:+$targets, }ha-constraints-dev"
+          [ -n "$targets" ] || exit 0
+          body="Target: $targets
+          Run: $RUN_URL"
+          number=$(gh issue list --state open --limit 100 --json number,title \
+            | jq -r --arg t "$title" 'map(select(.title == $t))[0].number // empty')
+          if [ -n "$number" ]; then
+            gh issue comment "$number" --body "$body"
+          else
+            gh issue create --title "$title" --body "$body"
+          fi

aiorainpoint-0.1.0/.github/workflows/release-please.yml

@@ -0,0 +1,121 @@
+name: Release Please
+
+# One file on purpose: the PyPI and TestPyPI publisher records bind to this
+# filename and to the pypi environment, and neither accepts a reusable workflow.
+# There is no concurrency group, so a release run waiting on the pypi reviewer
+# never cancels or queues a TestPyPI rehearsal dispatch.
+
+on:
+  push:
+    branches:
+      - main
+  # A push event is not guaranteed to arrive. A dispatch with an empty ref
+  # re-runs release-please alone and is the recovery path.
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Commit, branch or tag to build and upload to TestPyPI. Leave empty for a normal release run.
+        type: string
+        required: false
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      version: ${{ steps.release.outputs.version }}
+    steps:
+      - name: Generate app token
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ secrets.RELEASE_PLEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_PLEASE_APP_PRIVATE_KEY }}
+          # Scoped to what release-please uses: contents for the version bump,
+          # tag and release; pull-requests for the release PR and its labels.
+          permission-contents: write
+          permission-pull-requests: write
+
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        id: release
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+
+  # Runs the repository's code and suite, so it holds no id-token permission.
+  build:
+    needs: release-please
+    if: >-
+      needs.release-please.outputs.release_created == 'true'
+      || (github.event_name == 'workflow_dispatch' && inputs.ref != '')
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && inputs.ref || needs.release-please.outputs.tag_name }}
+          persist-credentials: false
+
+      - name: Set up Python 3.13
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+        with:
+          python-version: "3.13"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
+        with:
+          enable-cache: false
+
+      - name: Build the sdist and the wheel
+        run: uv build
+
+      - name: Check the archives
+        run: python scripts/check_dist.py dist
+
+      - name: Install the wheel into a clean venv
+        run: |
+          uv venv "$RUNNER_TEMP/wheel-venv" --python 3.13
+          uv pip install --python "$RUNNER_TEMP/wheel-venv/bin/python" dist/*.whl -r requirements-test.txt
+
+      # EXPECTED_VERSION is empty on a dispatch, so only a release asserts the version.
+      - name: Smoke-test the installed wheel
+        working-directory: ${{ runner.temp }}
+        env:
+          EXPECTED_VERSION: ${{ needs.release-please.outputs.version }}
+        run: |
+          "$RUNNER_TEMP/wheel-venv/bin/python" -I "$GITHUB_WORKSPACE/scripts/smoke_installed.py" ${EXPECTED_VERSION:+"$EXPECTED_VERSION"}
+
+      - name: Run the whole suite against the wheel
+        run: |
+          mkdir "$RUNNER_TEMP/wheel-run"
+          cp -r tests scripts pyproject.toml "$RUNNER_TEMP/wheel-run/"
+          cd "$RUNNER_TEMP/wheel-run"
+          "$RUNNER_TEMP/wheel-venv/bin/python" -m pytest --no-cov --tb=short
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: dist
+          path: dist/
+          if-no-files-found: error
+
+  # Only the job that mints the OIDC token, and it runs no repository code.
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: dist
+          path: dist/
+
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
+        with:
+          repository-url: ${{ github.event_name == 'workflow_dispatch' && inputs.ref != '' && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}