{#- OZI 0.2
# ozi/templates/github_workflows/publish.yml
# SPDX-License-Identifier: Unlicense
#}
  publish:
    runs-on: ubuntu-latest
    needs: [draft, release, generate-provenance]
    if: needs.draft.outputs.drafted == 'true'
    permissions:
      contents: write
      id-token: write
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
      with:
        disable-sudo: true
        egress-policy: block
        allowed-endpoints: >
          api.github.com:443
          upload.pypi.org:443
          uploads.github.com:443

    - uses: OZI-Project/publish@{{ spec.python.ci.publish.version }}
      with:
{%- raw %}
        github-token: ${{ secrets.GITHUB_TOKEN }}
{%- endraw %}
