ci: publish only via manual workflow_dispatch

Author: vistart

.github/workflows/publish.yml

@@ -1,13 +1,8 @@
+# .github/workflows/publish.yml
 name: Python Package Publish
 
 on:
-  workflow_run:
-    workflows: ["Python Test"]
-    types:
-      - completed
-    branches:
-      - main
-
+  # 手动触发发布工作流
   workflow_dispatch:
     inputs:
       destination:
@@ -19,79 +14,86 @@ on:
           - testpypi
           - pypi
 
-permissions:
-  contents: write
-  packages: write
-
 jobs:
+  # 检查测试工作流是否成功完成
   check-tests:
     runs-on: ubuntu-latest
-    if: >-
+    permissions:
+      contents: read
+    if: >
       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') ||
       github.event_name == 'workflow_dispatch'
     steps:
       - name: Success check
         run: echo "前置测试通过，可以继续执行发布流程"
 
+  # 发布到TestPyPI
   publish-testpypi:
     name: Publish to TestPyPI
     needs: check-tests
-    if: >-
+    if: >
       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') ||
       (github.event_name == 'workflow_dispatch' && github.event.inputs.destination == 'testpypi')
     runs-on: ubuntu-latest
-    environment: publish-testpypi
+    environment: publish-testpypi  # 使用需要审批的环境
     permissions:
+      # Required for trusted publishing
       id-token: write
+      contents: read
 
     steps:
-      - name: Check out the repository
-        uses: actions/checkout@v6
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.13"
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install build twine
-
-      - name: Build package
-        run: python -m build
-
-      - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          repository-url: https://test.pypi.org/legacy/
-          skip-existing: true
-
+    - name: Check out the repository
+      uses: actions/checkout@v6
+
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: "3.13"
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install build twine
+
+    - name: Build package
+      run: python -m build
+
+    - name: Publish to TestPyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: https://test.pypi.org/legacy/
+        skip-existing: true
+        # Note: removed user and password fields to use Trusted Publishers
+
+  # 发布到PyPI
   publish-pypi:
     name: Publish to PyPI
     needs: check-tests
     if: github.event_name == 'workflow_dispatch' && github.event.inputs.destination == 'pypi'
     runs-on: ubuntu-latest
-    environment: publish-pypi
+    environment: publish-pypi  # 使用需要严格审批的环境
     permissions:
+      # Required for trusted publishing
       id-token: write
+      contents: read
 
     steps:
-      - name: Check out the repository
-        uses: actions/checkout@v6
+    - name: Check out the repository
+      uses: actions/checkout@v6
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: "3.13"
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: "3.13"
 
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install build twine
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install build twine
 
-      - name: Build package
-        run: python -m build
+    - name: Build package
+      run: python -m build
 
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+    - name: Publish to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      # Note: removed user and password fields to use Trusted Publishers