[chrisjsewell]

What and why

The release build is broken: the next v* tag would fail before anything reaches PyPI.

The publish job runs pip install flit~=3.4 and then flit build.
That now resolves flit 3.12.0 with flit_core 4.2.0 (flit 3.12 requires flit_core>=3.12.0 with no upper bound),
and flit build crashes:

TypeError: SdistBuilder.build() got an unexpected keyword argument 'gen_setup_py'

This PR changes .github/workflows/tests.yml, keeping its file name, which the PyPI trusted publisher names:

• New build job, run on every push and PR.
  It runs python -m build, which builds with the project's own [build-system] pin (flit_core >=3.4,<4),
  so the release build can no longer drift from it.
  Then twine check --strict dist/*.
  On a tag push it also checks that dist/ holds exactly one wheel and one sdist, and that the tag matches their version.
  It uploads dist/ as an artifact, and allgood now needs it, so a broken build shows up on PRs instead of at release time.
• publish publishes that artifact.
  It downloads it and uploads it with pypa/gh-action-pypi-publish (trusted publishing; attestations are on by default).
  It needs pre-commit, tests and build, runs only for v* tag pushes, uses the pypi environment,
  and its only permission is id-token: write.
  (Its job-level if used to match any tag, but the trigger already limited tag runs to v*, so that does not change.)
• Read-only default permissions. The workflow gets a top-level permissions: contents: read.

How it was tested

• The failure on master, reproduced (Python 3.10, as in the old job):
  pip install "flit~=3.4" installed flit 3.12.0 + flit_core 4.2.0, and flit build exited 1 with the TypeError above.
• The new build, run locally on Python 3.13 with the same commands as the job:
  • python -m build exited 0 and built mdit_py_plugins-0.7.0.tar.gz and mdit_py_plugins-0.7.0-py3-none-any.whl.
  • twine check --strict dist/* passed for both.
• The tag check, run from the workflow text against those files:
  • v0.7.0: exit 0;
  • v0.7.1 and v0.7: exit 1, with tag v0.7.1 != built version(s) ['0.7.0'];
  • a dist/ with only the wheel, only the sdist, or nothing: exit 1, with expected one wheel and one sdist, got 1 and 0 (and so on).
• actionlint reports nothing new.
  It still reports one finding on master, which this PR does not touch: SC2102 on pip install -e .[testing] in tests.
• pre-commit run --all-files passes.
• pytest: 511 passed (Python 3.13). No package code changed.

Distribution contents compared with PyPI 0.6.1

• Wheel: the same files, plus the new mdit_py_plugins/section_ref/ (✨ NEW: Add section reference plugin (section_ref) #144).
  METADATA is identical apart from Version, and WHEEL names the same generator, currently flit 3.12.0
  (the release build gets whichever flit_core the >=3.4,<4 range resolves to when the tag is pushed).
• sdist: 71 files become 62.
  • Added: the two section_ref modules.
  • No longer shipped: .coveragerc, .github/dependabot.yml, .github/workflows/copilot-setup-steps.yml,
    .github/workflows/tests.yml, .gitignore, .pre-commit-config.yaml, .readthedocs.yml, AGENTS.md,
    CHANGELOG.md, codecov.yml and tox.ini.
    The flit CLI added these from version control; the PEP 517 backend does not.
  • Still shipped: the package, LICENSE, README.md, pyproject.toml and PKG-INFO.
  • tests/ and docs/ were already excluded by [tool.flit.sdist] and still are.
  • The conda-forge feedstock builds from the sdist, but the only file it reads is LICENSE (license_file).

Notes for the reviewer

• CI has not run on these commits yet.
  push triggers only on master and tags, so the build job first runs when this PR is opened.
• The publish job itself first runs on the v0.7.0 tag.
  That tag push is also the first upload through trusted publishing (0.6.1 was uploaded with the token).
• The new jobs use the current action majors (checkout@v7, setup-python@v7, upload-artifact@v7, download-artifact@v8).
  The existing jobs still use checkout@v4 / setup-python@v5; they are bumped separately.
• Not in this PR:
  • creating a GitHub Release on a tag;
  • a required reviewer on the pypi environment;
  • the Codecov upload;
  • pinning build / twine and SHA-pinning the actions (the repo pins neither today);
  • shipping tests/ and tox.ini in the sdist, which needs a pyproject.toml change.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.90%. Comparing base (d11bdaf) to head (3e13512).
⚠️ Report is 17 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #164      +/-   ##
==========================================
+ Coverage   92.80%   92.90%   +0.10%     
==========================================
  Files          31       40       +9     
  Lines        1835     2284     +449     
==========================================
+ Hits         1703     2122     +419     
- Misses        132      162      +30     

Flag	Coverage Δ
pytests	92.90% <ø> (+0.10%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.