safeuploads 1.1.0__tar.gz → 1.1.1__tar.gz

safeuploads-1.1.1/.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# Every change needs a review from the maintainer. safeuploads is maintained by one
+# person (see CONTRIBUTING.md), so this is a single entry rather than a routing
+# table — it exists so review is requested automatically rather than remembered.
+* @joaovitoriasilva

safeuploads-1.1.1/.github/FUNDING.yml

@@ -0,0 +1,13 @@
+# These are supported funding model platforms
+
+github: joaovitoriasilva # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: endurain # Replace with a single Patreon username
+#open_collective: # Replace with a single Open Collective username
+#ko_fi: # Replace with a single Ko-fi username
+#tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+#community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: endurain # Replace with a single Liberapay username
+#issuehunt: # Replace with a single IssueHunt username
+#otechie: # Replace with a single Otechie username
+#lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
+custom: ['https://buymeacoffee.com/endurain'] # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

{safeuploads-1.1.0/.forgejo → safeuploads-1.1.1/.github}/PULL_REQUEST_TEMPLATE.md

@@ -30,4 +30,4 @@ Check all that apply
 
 ## Notes for the reviewer
  
-Anything that would help review this. Tricky areas, alternative approaches considered, screenshots, etc.
+Anything that would help review this. Tricky areas, alternative approaches considered, screenshots, etc.

{safeuploads-1.1.0 → safeuploads-1.1.1}/.github/copilot-instructions.md

@@ -77,7 +77,7 @@ Committing should use clear messages following [Conventional Commits](https://ww
 
 **Format:** `<type>(<scope>)!: <description>` — `(<scope>)` and the breaking-change `!` are optional.
 
-The following rules are enforced automatically on every PR (against the PR title and every commit subject) by `.forgejo/workflows/conventional-commits.yml`. Validation follows the [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) spec, with a single project-policy addition (the allowed-type whitelist). Generated commit messages must comply:
+The following rules are enforced automatically on every PR (against the PR title and every commit subject) by `.github/workflows/conventional-commits.yml`. Validation follows the [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/) spec, with a single project-policy addition (the allowed-type whitelist). Generated commit messages must comply:
 
 - **Header format:** `<type>(<scope>)!: <description>` — the `(<scope>)` and breaking-change `!` are optional, and a space is required after the colon.
 - **Allowed types (project policy):** `build`, `chore`, `ci`, `docs`, `feat`, `fix`, `perf`, `refactor`, `revert`, `style`, `test`. Types are matched case-insensitively per the spec.

safeuploads-1.1.1/.github/dependabot.yml

@@ -0,0 +1,56 @@
+# Dependabot keeps dependencies *fresh*; the separate `audit-safeuploads` workflow
+# is what catches an advisory against a version already pinned. Both are needed.
+#
+# Updates are grouped so a week's worth of patch bumps arrives as one reviewable
+# pull request rather than a dozen. `uv.lock` is regenerated by Dependabot's uv
+# support, so the lockfile and `pyproject.toml` stay in step.
+version: 2
+
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+    commit-message:
+      # Matches the Conventional Commits check in `conventional-commits.yml`.
+      prefix: chore
+      include: scope
+    groups:
+      # The runtime dependency set is small and deliberate, so these are worth
+      # reading individually rather than batching.
+      production-dependencies:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+      development-dependencies:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+
+  # Every action is pinned to a commit SHA, so without this they never move.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "05:30"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      github-actions:
+        patterns:
+          - "*"

{safeuploads-1.1.0/.forgejo → safeuploads-1.1.1/.github}/scripts/check_conventional_commits.py

@@ -12,9 +12,9 @@ Usage::
     check_conventional_commits.py "feat(api): add endpoint"
     git log --format=%s base..head | check_conventional_commits.py --stdin
 
-Designed to run with the Python interpreter already available on the Forgejo
-runner image. Uses only the standard library so there is no third-party
-supply-chain surface.
+Designed to run with the Python interpreter already available on the GitHub
+Actions runner image. Uses only the standard library so there is no
+third-party supply-chain surface.
 """
 
 from __future__ import annotations

safeuploads-1.1.1/.github/scripts/smoke_import.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Smoke-test that the built safeuploads wheel is self-contained.
+
+Imports the installed package (not the source tree) and constructs
+a FileValidator to prove the distribution's declared dependencies
+are sufficient to actually use the library.
+"""
+
+from __future__ import annotations
+
+import sys
+from importlib.metadata import version
+
+from safeuploads import FileSecurityConfig, FileValidator
+
+
+def main() -> int:
+    """Exercise the installed package and return a process exit code.
+
+    Returns:
+        0 on success, 1 if a check fails.
+    """
+    print(f"safeuploads version: {version('safeuploads')}")
+
+    validator = FileValidator(config=FileSecurityConfig())
+    if not isinstance(validator, FileValidator):
+        print("FileValidator construction failed.", file=sys.stderr)
+        return 1
+
+    print("Smoke test passed: package imported and validator built.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

safeuploads-1.1.1/.github/workflows/audit-safeuploads.yml

@@ -0,0 +1,58 @@
+name: Audit dependencies
+
+# Dependabot keeps dependencies *fresh*; it does not tell you when a version you
+# are already pinned to turns out to be vulnerable. This job scans the resolved
+# lockfile against the OSV / PyPI advisory databases, on every dependency change
+# and on a schedule so a newly-published advisory against an unchanged pin is
+# still surfaced.
+
+on:
+  push:
+    branches:
+      - main
+    paths: &paths
+      - pyproject.toml
+      - uv.lock
+      - .github/workflows/audit-safeuploads.yml
+  pull_request:
+    paths: *paths
+  schedule:
+    # Daily, offset from the dependency-update run so the two do not contend.
+    - cron: '30 5 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit:
+    name: safeuploads (pip-audit)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          # Resolve uv from `[tool.uv] required-version` in pyproject.toml, so CI
+          # and local development are held to the same floor and ceiling.
+          version-file: pyproject.toml
+
+      # Audit the full resolved set - runtime dependencies plus every optional
+      # extra - because a host enabling ``safeuploads[fastapi]`` inherits those too.
+      # ``--no-emit-project`` drops the editable self-reference, which carries no
+      # hash and which pip-audit therefore rejects.
+      - name: Export the resolved dependency set
+        run: >-
+          uv export --frozen --all-extras --no-dev --no-emit-project
+          --format requirements-txt --output-file "$RUNNER_TEMP/requirements.txt"
+
+      - name: Scan for known vulnerabilities
+        run: uvx pip-audit --strict --requirement "$RUNNER_TEMP/requirements.txt" --disable-pip

{safeuploads-1.1.0/.forgejo → safeuploads-1.1.1/.github}/workflows/conventional-commits.yml

@@ -5,16 +5,19 @@ on:
     types: [opened, edited, synchronize, reopened]
 
 concurrency:
-  group: ${{ forgejo.workflow }}-${{ forgejo.event.pull_request.number }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   validate:
-    runs-on: local-runner
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -22,19 +25,19 @@ jobs:
         # The PR title is passed through an environment variable to prevent
         # shell injection via crafted titles (see security-and-owasp guidelines).
         env:
-          PR_TITLE: ${{ forgejo.event.pull_request.title }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
-          python3 .forgejo/scripts/check_conventional_commits.py "$PR_TITLE"
+          python3 .github/scripts/check_conventional_commits.py "$PR_TITLE"
 
       - name: Validate commits in PR
         # Validates every commit subject between the PR base and head. Use the
         # base/head SHAs from the event payload so we don't depend on the local
         # checkout ref layout.
         env:
-          BASE_SHA: ${{ forgejo.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ forgejo.event.pull_request.head.sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
           git fetch --no-tags origin "$BASE_SHA" "$HEAD_SHA"
           git log --no-merges --format=%s "$BASE_SHA".."$HEAD_SHA" \
-            | python3 .forgejo/scripts/check_conventional_commits.py --stdin
+            | python3 .github/scripts/check_conventional_commits.py --stdin

safeuploads-1.1.1/.github/workflows/docs.yml

@@ -0,0 +1,81 @@
+name: Deploy documentation
+
+# ``dry-run`` only exists on ``workflow_dispatch``. On a push ``inputs.dry-run``
+# is null, so every ``!= true`` guard below passes and the site deploys.
+on:
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: Build docs but do not deploy
+        required: false
+        default: false
+        type: boolean
+  push:
+    branches:
+      - main
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - 'safeuploads/**/*.py'
+      - '.github/workflows/docs.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: github-pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build documentation
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          # Resolve uv from `[tool.uv] required-version` in pyproject.toml, so CI
+          # and local development are held to the same floor and ceiling.
+          version-file: pyproject.toml
+
+      # mkdocstrings imports the package to render the API reference, so sync the
+      # default dependencies plus the docs group and install the project itself.
+      - name: Sync documentation dependencies
+        run: uv sync --frozen --group docs
+
+      - name: Build documentation
+        run: uv run --no-sync mkdocs build --site-dir site
+
+      - name: Configure GitHub Pages
+        if: ${{ inputs.dry-run != true }}
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+
+      - name: Upload GitHub Pages artifact
+        if: ${{ inputs.dry-run != true }}
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: site
+
+  deploy:
+    name: Deploy documentation
+    if: ${{ inputs.dry-run != true }}
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

{safeuploads-1.1.0/.forgejo → safeuploads-1.1.1/.github}/workflows/fuzz.yml

@@ -6,28 +6,31 @@ on:
     - cron: "0 3 * * 0"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 # Cancel in-progress runs for the same branch to avoid wasted
 # runner minutes.
 concurrency:
-  group: ${{ forge.workflow }}-${{ forge.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   fuzz:
     name: Fuzz
-    runs-on: local-runner
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install system dependencies
-        run: apt-get update && apt-get install -y libmagic1
+        run: sudo apt-get update && sudo apt-get install -y libmagic1
 
       - name: Install uv
-        uses: https://data.forgejo.org/astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          working-directory: .
+          version-file: pyproject.toml
 
       - name: Install dependencies
         run: uv sync --frozen --dev

{safeuploads-1.1.0/.forgejo → safeuploads-1.1.1/.github}/workflows/lint-and-test.yml

@@ -6,10 +6,13 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 # Cancel in-progress runs for the same branch/PR to avoid wasted
 # runner minutes and race conditions on shared resources.
 concurrency:
-  group: ${{ forge.workflow }}-${{ forge.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -20,18 +23,20 @@ jobs:
   # ----------------------------------------------------------------
   lint:
     name: Lint
-    runs-on: codeberg-tiny
+    runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
       - name: Install uv
-        uses: https://data.forgejo.org/astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          working-directory: .
+          # Resolve uv from `[tool.uv] required-version` in pyproject.toml, so CI
+          # and local development are held to the same floor and ceiling.
+          version-file: pyproject.toml
 
       - name: Install dependencies
         run: uv sync --frozen --dev
@@ -52,20 +57,20 @@ jobs:
   # ----------------------------------------------------------------
   test:
     name: Test
-    runs-on: local-runner
+    runs-on: ubuntu-latest
     needs: lint
 
     steps:
       - name: Checkout repository
-        uses: https://data.forgejo.org/actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install system dependencies
-        run: apt-get update && apt-get install -y libmagic1
+        run: sudo apt-get update && sudo apt-get install -y libmagic1
 
       - name: Install uv
-        uses: https://data.forgejo.org/astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
-          working-directory: .
+          version-file: pyproject.toml
 
       - name: Install dependencies
         run: uv sync --frozen --dev --extra fastapi
@@ -77,7 +82,7 @@ jobs:
         run: uv run pytest --cov-fail-under=90
 
       - name: Upload coverage report
-        uses: https://data.forgejo.org/forgejo/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: safeuploads-coverage

safeuploads-1.1.1/.github/workflows/mirror.yml

@@ -0,0 +1,30 @@
+name: Mirror to GitLab
+
+on:
+  push:
+
+concurrency:
+  group: gitlab-mirror
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  mirror:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Push full mirror to GitLab
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
+        run: |
+          set -euo pipefail
+          mirror_dir="$RUNNER_TEMP/safeuploads.git"
+          git clone --mirror \
+            "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \
+            "$mirror_dir"
+          cd "$mirror_dir"
+          git remote set-url --push origin \
+            "https://oauth2:${GITLAB_TOKEN}@gitlab.com/endurain-project/safeuploads.git"
+          git push --mirror

safeuploads-1.1.1/.github/workflows/publish-safeuploads.yml

@@ -0,0 +1,170 @@
+name: Publish safeuploads
+
+# Builds and publishes a release to PyPI when a ``v*`` tag is pushed. The
+# unprivileged build job validates the release and uploads its artifacts; the
+# separate ``pypi`` environment job receives OIDC permission only when it needs
+# to generate PEP 740 attestations and publish through Trusted Publishing.
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: Build and verify, but do not upload to PyPI
+        required: false
+        default: true
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build and verify
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          # Resolve uv from `[tool.uv] required-version` in pyproject.toml, so CI
+          # and local development are held to the same floor and ceiling.
+          version-file: pyproject.toml
+          enable-cache: false
+
+      # A tag that disagrees with the packaged version produces a release whose
+      # artifact name does not match its tag - catch it before anything is
+      # uploaded, because a PyPI version can never be re-used.
+      - name: Verify the tag matches the project version
+        if: startsWith(github.ref, 'refs/tags/v')
+        env:
+          TAG_REF: ${{ github.ref }}
+        run: |
+          set -euo pipefail
+          tag_version="${TAG_REF#refs/tags/v}"
+          project_version="$(uv version --short)"
+          if [ "$tag_version" != "$project_version" ]; then
+            echo "Tag v${tag_version} does not match pyproject version ${project_version}." >&2
+            exit 1
+          fi
+          echo "Releasing version ${project_version}."
+
+      - name: Verify the changelog documents this version
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          set -euo pipefail
+          version="$(uv version --short)"
+          if ! grep -q "^## \[${version}\]" CHANGELOG.md; then
+            echo "CHANGELOG.md has no '## [${version}]' section." >&2
+            exit 1
+          fi
+
+      # The full gate runs on every PR, but a tag can point anywhere in history,
+      # so re-run it here: a release must never ship code that does not pass.
+      - name: Sync dependencies
+        run: uv sync --frozen --dev --extra fastapi
+
+      - name: Lint, type check and test
+        run: |
+          set -euo pipefail
+          uv run --no-sync ruff check safeuploads tests examples
+          uv run --no-sync ruff format --check safeuploads tests examples
+          uv run --no-sync mypy
+          uv run --no-sync pytest --cov-fail-under=90
+
+      - name: Build sdist and wheel
+        run: uv build --no-sources
+
+      - name: Verify package metadata renders on PyPI
+        run: uvx twine check --strict dist/*
+
+      # Prove the wheel is self-contained: install it into a clean environment
+      # with no dev groups and no optional extras, then import and assemble it
+      # from outside the repository (so the source tree cannot shadow it).
+      - name: Smoke-test the built wheel
+        run: |
+          set -euo pipefail
+          smoke_venv="$RUNNER_TEMP/smoke"
+          uv venv "$smoke_venv"
+          VIRTUAL_ENV="$smoke_venv" uv pip install dist/*.whl
+          cd "$RUNNER_TEMP"
+          VIRTUAL_ENV="$smoke_venv" uv run --no-project python "$GITHUB_WORKSPACE/.github/scripts/smoke_import.py"
+
+      # An SBOM of what the *distribution* actually pulls in, taken from the
+      # clean venv the smoke test just installed the wheel into. Running it
+      # against the build environment instead would describe this workflow's own
+      # toolchain — ruff, mypy, pytest — which is not what a consumer inherits.
+      - name: Generate SBOM (CycloneDX)
+        run: |
+          set -euo pipefail
+          mkdir -p release-metadata
+          uvx --from cyclonedx-bom cyclonedx-py environment "$RUNNER_TEMP/smoke" \
+            --output-format json --output-file release-metadata/safeuploads-sbom.cdx.json
+
+      - name: Generate checksums
+        run: |
+          set -euo pipefail
+          sha256sum dist/* > release-metadata/SHA256SUMS
+          cat release-metadata/SHA256SUMS
+
+      # ``dist/`` holds the wheel and the sdist and nothing else: the publish job
+      # attests everything it downloads, so a stray checksum or SBOM file there
+      # would end up in the attestation.
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: safeuploads-dist
+          path: dist/
+          if-no-files-found: error
+          retention-days: 90
+
+      - name: Upload release metadata
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: safeuploads-release-metadata
+          path: release-metadata/
+          if-no-files-found: error
+          retention-days: 90
+
+  publish:
+    name: Publish to PyPI
+    if: ${{ startsWith(github.ref, 'refs/tags/v') && inputs.dry-run != true }}
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/safeuploads
+    permissions:
+      id-token: write
+    steps:
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          # This job never checks the repository out, so there is no
+          # pyproject.toml to read `required-version` from; keep this in step
+          # with the floor declared there.
+          version: "0.12.5"
+          enable-cache: false
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: safeuploads-dist
+          path: dist/
+
+      - name: Generate PEP 740 attestations
+        uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6
+
+      - name: Publish to PyPI
+        run: uv publish --trusted-publishing always dist/*.whl dist/*.tar.gz