publish #3

	name: publish

	on:
	push:
	tags:
	- "v*"
	workflow_dispatch:

	jobs:
	test:
	name: Run tests
	runs-on: ubuntu-latest
	permissions:
	contents: read
	# 2026-07-08: parallel matrix kept (PyPI publish is a one-shot
	# event and the runner is already paid for) but pip cache
	# brought in for parity with ci.yml.
	strategy:
	matrix:
	python-version: ["3.10", "3.11", "3.12"]

	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-python@v5
	with:
	python-version: ${{ matrix.python-version }}
	cache: "pip"
	cache-dependency-path: pyproject.toml

	- name: Install dependencies
	run: pip install -e ".[dev]" "pytest-xdist>=3.6"

	- name: Run tests
	run: pytest tests/ -v -n auto

	publish:
	name: Build and publish
	needs: test
	runs-on: ubuntu-latest
	environment:
	name: pypi
	url: https://pypi.org/p/nullrun
	permissions:
	id-token: write

	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"

	- name: Build
	run: \|
	pip install --upgrade build
	python -m build

	- name: Check dist
	run: \|
	pip install twine
	twine check dist/*

	- name: Publish to PyPI (Trusted Publishing)
	uses: pypa/gh-action-pypi-publish@release/v1

Provide feedback