Merge pull request #82 from ThreeFish-AI/vk/41ee-github-actions-w

ci(github-actions): 新增 PyPI 发布 API Token 回退认证模式

Author: ThreeFish-AI

.github/workflows/release.yml

@@ -11,10 +11,17 @@
 #   - prerelease == true  --> TestPyPI (with skip-existing tolerance)
 #   - prerelease == false --> PyPI production (fail loudly on duplicates)
 #
-# Pre-requisites:
-#   1. Create GitHub Environments: "pypi" and "testpypi"
-#   2. Configure Trusted Publishers on PyPI/TestPyPI admin panels
-#   3. (Recommended) Set "Required reviewers" on "pypi" environment
+# Pre-requisites (choose ONE authentication method):
+#
+#   Option A — OIDC Trusted Publishing (recommended, no secrets needed):
+#     1. Create GitHub Environments: "pypi" and "testpypi"
+#     2. Configure Trusted Publishers on PyPI/TestPyPI admin panels
+#     3. (Recommended) Set "Required reviewers" on "pypi" environment
+#
+#   Option B — API Token Fallback (simpler initial setup):
+#     1. Set repository secrets: PYPI_API_TOKEN and/or TEST_PYPI_API_TOKEN
+#     2. (Optional) Create "pypi"/"testpypi" environments for deployment guards
+#        If environments are not created, remove the `environment:` blocks below.
 #
 # References:
 #   [1] https://packaging.python.org/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
@@ -102,6 +109,7 @@ jobs:
       - name: Publish to TestPyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
+          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
           repository-url: https://test.pypi.org/legacy/
           skip-existing: true
 
@@ -130,3 +138,5 @@ jobs:
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}