v0.3.1 — nested refs + TeamRef metadata #6

	name: Publish to PyPI

	on:
	release:
	types: [published]
	# workflow_dispatch lets operators dry-run the test matrix + gate
	# wiring without cutting a real release (the actual PyPI upload step
	# is guarded against non-release triggers, see below). Useful for
	# verifying the gate after edits to test.yml or publish.yml.
	workflow_dispatch:

	jobs:
	# Mirrors test.yml on the tagged commit: lint + typecheck across the
	# support matrix before publish. PyPI versions are immutable, so any
	# gate we can apply pre-upload is cheaper than publishing a broken
	# release. needs: gate below blocks publish on every matrix entry.
	gate:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	python-version: ["3.10", "3.11", "3.12", "3.13"]

	steps:
	- uses: actions/checkout@v6

	- uses: actions/setup-python@v6
	with:
	python-version: ${{ matrix.python-version }}

	- name: Install dependencies
	run: \|
	pip install -e ".[pandas]"
	pip install ruff pyright

	- name: Ruff check
	run: ruff check

	- name: Pyright
	run: pyright

	publish:
	needs: gate
	runs-on: ubuntu-latest
	permissions:
	id-token: write

	steps:
	- uses: actions/checkout@v6

	- uses: actions/setup-python@v6
	with:
	python-version: "3.12"

	- name: Install build tools
	run: pip install hatch

	- name: Build
	run: hatch build

	- name: Publish to PyPI
	# Only publish on an actual release event. workflow_dispatch
	# runs through test+build as a dry run but must not upload.
	if: github.event_name == 'release'
	uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1

Provide feedback