{#- OZI 0.1
# ozi/templates/github_workflows/publish.yml
# Part of the OZI Project, under the Apache License v2.0 with LLVM Exceptions.
# See LICENSE.txt for license information.
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
#}
  publish:
    runs-on: ubuntu-latest
    needs: [release, generate-provenance]
    if: needs.release.outputs.drafted == 'true'
    permissions:
      contents: write
      id-token: write
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
      with:
        disable-sudo: true
        egress-policy: block
        allowed-endpoints: >
          api.github.com:443
          upload.pypi.org:443
          uploads.github.com:443

    - uses: OZI-Project/publish@{{ spec.python.ci.publish.version }}
      with:
{%- raw %}
        github-token: ${{ secrets.GITHUB_TOKEN }}
        ssh-public: ${{ env.SSH_PUBKEY }}
        ssh-private: ${{ secrets.SSH_PRVKEY }}
{%- endraw %}
