@@ -0,0 +1,50 @@
+name: Publish to PyPI
+
+# Fires on a semver tag (v0.2.0, v1.0.0-prod, etc.). The job builds the wheel +
+# sdist and publishes via PyPI Trusted Publishing (OIDC). No long-lived API token
+# is stored — the trusted publisher must be configured on PyPI under:
+#   Project settings → Publishing → Add a new publisher → GitHub
+#     owner: mizcausevic-dev
+#     repository: aeo-sdk-python
+#     workflow filename: publish.yml
+#     environment: pypi
+#
+# If you prefer a token-based flow, add a PYPI_API_TOKEN secret and replace
+# the gh-action-pypi-publish step with:
+#   with:
+#     password: ${{ secrets.PYPI_API_TOKEN }}
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  id-token: write   # required for trusted publishing
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/aeo-protocol/
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install build deps
+        run: python -m pip install --upgrade pip build
+      - name: Build sdist + wheel
+        run: python -m build
+      - name: Verify tag matches pyproject.toml version
+        run: |
+          TAG="${GITHUB_REF_NAME#v}"
+          PKG_VERSION=$(grep '^version = ' pyproject.toml | head -1 | cut -d '"' -f2)
+          if [ "$TAG" != "$PKG_VERSION" ]; then
+            echo "::error::Git tag ($TAG) does not match pyproject.toml version ($PKG_VERSION)"
+            exit 1
+          fi
+      - name: Publish to PyPI (trusted publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1