From 2426178baab564ca05381f2fc3b6af74525a1130 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Donncha=20=C3=93=20Cearbhaill?=
 <donncha.ocearbhaill@amnesty.org>
Date: Tue, 22 Sep 2026 13:02:49 +0200
Subject: [PATCH] Enable automated PyPI deployments for tagged releases (#943)

* Limit PyPi deploys to tag relaeses

* Remove unnecessary tests and docs from sdist build
---
 .github/workflows/release.yml | 1 +
 MANIFEST.in                   | 4 ++++
 2 files changed, 5 insertions(+)
 create mode 100644 MANIFEST.in

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3c20dc71..5acb3b51 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,6 +34,7 @@ jobs:
   publish:
     if: github.ref_type == 'tag'
     runs-on: ubuntu-latest
+    environment: pypi # only tag refs may deploy; the PyPI trusted publisher requires it
     permissions:
       id-token: write # PyPI trusted publishing
     steps:
diff --git a/MANIFEST.in b/MANIFEST.in
new file mode 100644
index 00000000..cc7f0b97
--- /dev/null
+++ b/MANIFEST.in
@@ -0,0 +1,4 @@
+prune tests
+prune docs
+prune .github
+exclude uv.lock Dockerfile* mkdocs.yml .readthedocs.yaml .safety-policy.yml .python-version .gitignore Makefile