Publish to PyPi workflow (dropbox/dropbox-sdk-python)

# This workflow will upload a Python Package using Twine when a release is created
# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries
 
name: Publish to PyPi
 
on:
  release:
    types: [created]
  workflow_dispatch:  # Allow manual trigger for testing
 
jobs:
  deploy:
    timeout-minutes: 30
    runs-on: latchkey-small
    permissions:  # required for OIDC authentication
      id-token: write
      contents: read
 
    steps:
    - uses: actions/checkout@v5
 
    - name: Configure AWS credentials (OIDC)
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::082972943155:role/oidc-github-dropbox-dropbox-sdk-python-repo
        aws-region: us-west-2
    - name: Get PyPI token from AWS Secrets Manager
      id: get-secret
      uses: aws-actions/aws-secretsmanager-get-secrets@v2
      with:
        # Referenced by friendly name; Secrets Manager appends a random suffix to
        # the full ARN, so the name is the stable identifier.
        secret-ids: |
          PYPI_SECRET,pypi-api-token-dropbox-sdk-python
        parse-json-secrets: false
    - name: Setup Python environment
      uses: actions/setup-python@v6
      with:
        cache: 'pip'
        python-version: "3.x"
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        python -m pip install build twine
    - name: Build sdist and wheel
      run: python -m build
    - name: Publish
      env:
        TWINE_USERNAME: __token__
        TWINE_PASSWORD: ${{ env.PYPI_SECRET }}
      run: |
        twine check dist/*
        twine upload dist/*