Update python-package.yml

Author: C-Achard

.github/workflows/python-package.yml

@@ -2,47 +2,26 @@ name: Build, validate & Release
 
 on:
   push:
-    tags:
-      - 'v*.*.*'
+    tags: [ 'v*.*.*' ]
   pull_request:
-    branches:
-      - main
-      - public
-    types:
-      - labeled
-      - opened
-      - edited
-      - synchronize
-      - reopened
+    branches: [ main, public ]
+    types: [ labeled, opened, edited, synchronize, reopened ]
 
 jobs:
-  build_check:
-    name: Build & validate package
+  test:
+    name: Test / smoke (matrix)
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        python-version: [ "3.10", "3.11", "3.12" ]  # adjust to what you support
+        python-version: [ "3.10", "3.11", "3.12" ]
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
-      # If we use UV later, the lock file should be included here for caching and validation
-      - name: Cache pip
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-${{ matrix.python-version }}-${{ hashFiles('pyproject.toml', 'setup.cfg', 'setup.py', 'requirements.txt') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-${{ matrix.python-version }}-
-            ${{ runner.os }}-pip-
-
-      - name: Install build tools
+      - name: Install tools
         run: |
           python -m pip install --upgrade pip
           python -m pip install build twine wheel "packaging>=24.2"
@@ -61,50 +40,63 @@ jobs:
 
       - name: Install from wheel & smoke test
         run: |
-          # Install from the built wheel (not from the source tree)
           python -m pip install dist/*.whl
-
           python - <<'PY'
           import importlib
-          pkg_name = "dlclivegui"  # change if your top-level import differs
+          pkg_name = "dlclivegui"
           m = importlib.import_module(pkg_name)
           print("Imported:", m.__name__, "version:", getattr(m, "__version__", "n/a"))
           PY
 
           if ! command -v dlclivegui >/dev/null 2>&1; then
-            echo "CLI entry point 'dlclivegui' not found in PATH; skipping CLI smoke test."
+          echo "CLI entry point 'dlclivegui' not found in PATH; skipping CLI smoke test."
           else
+          if command -v dlclivegui >/dev/null 2>&1; then
             echo "Running 'dlclivegui --help' smoke test..."
             if ! dlclivegui --help >/dev/null 2>&1; then
               echo "::error::'dlclivegui --help' failed; this indicates a problem with the installed CLI package."
               exit 1
             fi
-          fi
 
-  publish:
-    name: Publish to PyPI
+  build:
+    name: Build release artifacts (single)
     runs-on: ubuntu-latest
-    needs: build_check
-    if: ${{ startsWith(github.ref, 'refs/tags/v') }}  # only on tag pushes like v1.2.3
+    needs: test
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Setup Python
-        uses: actions/setup-python@v6
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
-          python-version: "3.x"
+          python-version: "3.12"
 
-      - name: Install build tools
+      - name: Build distributions (sdist + wheel)
         run: |
           python -m pip install --upgrade pip
-          python -m pip install build twine
+          python -m pip install build twine wheel "packaging>=24.2"
+          python -m build
+          python -m twine check dist/*
 
-      - name: Build distributions (sdist + wheel)
-        run: python -m build
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/*
+          if-no-files-found: error
+
+  publish:
+    name: Publish to PyPI (OIDC)
+    runs-on: ubuntu-latest
+    needs: build
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - name: Download dist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
 
       - name: Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.TWINE_API_KEY }}
-        run: python -m twine upload --verbose dist/*
+        uses: pypa/gh-action-pypi-publish@release/v1