{#- OZI 0.2
# ozi/templates/github_workflows/publish.yml
# SPDX-License-Identifier: Unlicense
#}
  publish:
    runs-on: ubuntu-latest
    needs: [draft, release, generate-provenance]
    if: needs.draft.outputs.drafted == 'true'
    permissions:
      contents: write
      id-token: write
    steps:
{%- if project.github_harden_runner %}
{% include "github_workflows/harden_runner.yml.j2" %}
        allowed-endpoints: >
            api.github.com:443
            upload.pypi.org:443
            uploads.github.com:443
            tuf-repo-cdn.sigstore.dev:443
            fulcio.sigstore.dev:443
            rekor.sigstore.dev:443
{%- endif %}

    - uses: OZI-Project/publish@{{ spec.python.ci.publish.version }}
      with:
{%- raw %}
        github-token: ${{ secrets.GITHUB_TOKEN }}
{%- endraw %}
