From 7f9ab7b924742ef22f017f6f564d747881d6917d Mon Sep 17 00:00:00 2001
From: Dewey Dunnington <dewey@wherobots.com>
Date: Sun, 27 Sep 2026 21:43:28 -0500
Subject: [PATCH] set up trustred publishing

---
 .github/workflows/release.yaml  | 90 +++++++++++++++++++++++++++++++++
 geoarrow-pandas/pyproject.toml  |  2 +-
 geoarrow-pyarrow/pyproject.toml |  2 +-
 geoarrow-types/pyproject.toml   |  2 +-
 4 files changed, 93 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/release.yaml

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..6756721
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,90 @@
+name: release
+
+on:
+  push:
+    tags:
+      - "geoarrow-types-*"
+      - "geoarrow-pyarrow-*"
+      - "geoarrow-pandas-*"
+
+permissions:
+  contents: read
+
+jobs:
+  select-package:
+    runs-on: ubuntu-latest
+
+    outputs:
+      package: ${{ steps.tag.outputs.package }}
+      version: ${{ steps.tag.outputs.version }}
+
+    steps:
+      - name: Validate release tag
+        id: tag
+        shell: bash
+        run: |
+          tag="${GITHUB_REF_NAME}"
+
+          if [[ ! "$tag" =~ ^(geoarrow-types|geoarrow-pyarrow|geoarrow-pandas)-([0-9]+\.[0-9]+\.[0-9]+)$ ]]; then
+            echo "::error::Invalid release tag: $tag"
+            exit 1
+          fi
+
+          echo "package=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
+          echo "version=${BASH_REMATCH[2]}" >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: select-package
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.14"
+
+      - name: Install build tools
+        run: python -m pip install --upgrade build twine
+
+      - name: Build ${{ needs.select-package.outputs.package }}
+        env:
+          PACKAGE_DIR: ${{ needs.select-package.outputs.package }}
+        run: python -m build --outdir dist "$PACKAGE_DIR"
+
+      - name: Check distributions
+        run: python -m twine check dist/*
+
+      - name: Upload distributions
+        uses: actions/upload-artifact@v7
+        with:
+          name: python-package-distributions
+          path: dist/
+          if-no-files-found: error
+
+  publish:
+    needs:
+      - select-package
+      - build
+
+    runs-on: ubuntu-latest
+
+    environment:
+      name: pypi
+      url: https://pypi.org/p/${{ needs.select-package.outputs.package }}
+
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@v8
+        with:
+          name: python-package-distributions
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/geoarrow-pandas/pyproject.toml b/geoarrow-pandas/pyproject.toml
index 4660c57..2b09039 100644
--- a/geoarrow-pandas/pyproject.toml
+++ b/geoarrow-pandas/pyproject.toml
@@ -41,7 +41,7 @@ build-backend = "setuptools.build_meta"
 
 [tool.setuptools_scm]
 root = ".."
-tag_regex = "geoarrow-pandas-([0-9.]+)"
+tag_regex = '^geoarrow-pandas-(?P<version>[0-9]+\.[0-9]+\.[0-9]+)$'
 git_describe_command = "git describe --long --match='geoarrow-pandas-*'"
 version_file = "src/geoarrow/pandas/_version.py"
 
diff --git a/geoarrow-pyarrow/pyproject.toml b/geoarrow-pyarrow/pyproject.toml
index e11ab4d..007d29b 100644
--- a/geoarrow-pyarrow/pyproject.toml
+++ b/geoarrow-pyarrow/pyproject.toml
@@ -41,7 +41,7 @@ build-backend = "setuptools.build_meta"
 
 [tool.setuptools_scm]
 root = ".."
-tag_regex = "geoarrow-pyarrow-([0-9]+.[0-9]+.[0-9]+)"
+tag_regex = '^geoarrow-pyarrow-(?P<version>[0-9]+\.[0-9]+\.[0-9]+)$'
 git_describe_command = "git describe --long --match='geoarrow-pyarrow-*'"
 version_file = "src/geoarrow/pyarrow/_version.py"
 
diff --git a/geoarrow-types/pyproject.toml b/geoarrow-types/pyproject.toml
index 82d3d79..ffd651f 100644
--- a/geoarrow-types/pyproject.toml
+++ b/geoarrow-types/pyproject.toml
@@ -41,7 +41,7 @@ build-backend = "setuptools.build_meta"
 
 [tool.setuptools_scm]
 root = ".."
-tag_regex = "geoarrow-types-([0-9.]+)"
+tag_regex = '^geoarrow-types-(?P<version>[0-9]+\.[0-9]+\.[0-9]+)$'
 git_describe_command = "git describe --long --match='geoarrow-types-*'"
 version_file = "src/geoarrow/types/_version.py"