• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feature/pypi-publishing

Reviewing files that changed from the base of the PR and between 8c6ef9e and 3cb070c.

• .github/workflows/ci.yml (3 hunks)
• .github/workflows/publish.yml (1 hunks)

.github/workflows/ci.yml (4)

8-9: Expanded branch triggers appropriately for release workflows.

Adding release/* and hotfix/* branches aligns with the publishing workflow changes and follows common gitflow patterns. This ensures CI runs on all relevant branches before publishing.

---

19-24: Good security and performance improvements in CI setup.

Updating to actions/checkout@v6 with persist-credentials: false reduces credential exposure, and enabling cache in astral-sh/setup-uv@v7 improves CI performance. These are solid modernization choices.

---

32-37: Consistent updates applied to typecheck job.

The same security and caching improvements from the lint job are correctly applied here.

---

47-53: Consistent updates applied across all Python versions in matrix.

The checkout and setup-uv updates are correctly propagated to the test job across all matrix configurations.

.github/workflows/publish.yml (7)

1-9: Trigger mechanism aligned with PyPI recommendations.

The shift from GitHub Release events to explicit branch and tag pushes is more predictable and aligns with PyPI's trusted publishing model. The conditional logic (if: github.ref_type == 'branch' for TestPyPI, if: github.ref_type == 'tag' for PyPI) correctly separates pre-release and production workflows.

---

12-29: Build job correctly separates artifact creation from publishing.

The dedicated build job creates distributions once and uploads them as artifacts, which both publish jobs then consume. This follows the recommended pattern of building once and reusing artifacts, improving reproducibility and reducing build latency.

---

16-24: Consistent security and caching setup across build job.

The checkout and setup-uv configuration mirrors the CI workflow improvements, maintaining consistency across the entire CI/CD pipeline.

---

31-42: Trusted publishing configuration for TestPyPI.

The environment reference and OIDC permissions (id-token: write) correctly enable GitHub's trusted publishing feature for TestPyPI. The skip-existing: true flag allows idempotent re-runs without failing on duplicate versions.

---

45-54: Correct artifact download and publish pattern for TestPyPI.

Artifacts are downloaded before publishing with the correct path matching the build job's upload path. Using pypa/gh-action-pypi-publish@release/v1 with repository-url for TestPyPI is the recommended approach and currently points to v1.13.0.

---

56-76: Trusted publishing configuration for PyPI.

The PyPI job mirrors TestPyPI's structure with OIDC permissions and environment reference. The tag-based conditional correctly gates PyPI publishing to tagged releases. Confirm that the publish-to-pypi job definition is complete and includes all necessary steps beyond line 76.

---

56-76: Version of pypa/gh-action-pypi-publish is appropriate and job structure is complete.

The release/v1 branch pointer is the official recommended replacement for the sunset master version, documented in the Python Packaging User Guide as the standard for trusted publishing to PyPI. The publish-to-pypi job is complete with proper artifact download and publishing steps, appropriate permissions, environment configuration, and conditional execution on tag events.