chore: scrub nested privacy structures recursively (#12) #14

	name: Release and PyPI Publish

	# ADMIN_TOKEN is the same organization-scoped release credential used by the
	# canonical Flow release. The default GITHUB_TOKEN cannot push the generated
	# version commit through protected main.

	on:
	push:
	branches:
	- main

	jobs:
	release:
	runs-on: ubuntu-latest
	concurrency: release
	permissions:
	id-token: write
	contents: write

	steps:
	- name: Checkout repository
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	fetch-depth: 0
	token: ${{ secrets.ADMIN_TOKEN }}

	- name: Set up Python
	uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
	with:
	python-version: '3.12'

	- name: Install uv
	uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
	with:
	version: '0.11.29'

	- name: Python Semantic Release
	id: release
	uses: python-semantic-release/python-semantic-release@39dd2052f2ce8282a5d932c31d58a2ca06d2550e # v10.6.1
	with:
	github_token: ${{ secrets.ADMIN_TOKEN }}

	- name: Build package
	if: steps.release.outputs.released == 'true'
	run: \|
	uv build
	python scripts/check_source_boundary.py --require-dist

	- name: Publish to PyPI
	if: steps.release.outputs.released == 'true'
	uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1

	- name: Publish to GitHub Releases
	if: steps.release.outputs.released == 'true'
	uses: python-semantic-release/publish-action@5a5718ce47b892ef699f2972dae122297771d641 # v10.6.1
	with:
	github_token: ${{ secrets.ADMIN_TOKEN }}

Navigation Menu