Merge pull request from GHSA-hvp4-vrv2-8wrq #1

	name: Publish Python 🐍 distribution 📦 to PyPI

	on:
	push:
	tags:
	- '*'

	jobs:
	build:
	name: Build distribution 📦
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.x"

	- name: Print environment
	run: \|
	python --version

	- name: Install pypa/build
	run: python3 -m pip install build

	- name: Build a binary wheel and a source tarball
	run: python3 -m build

	- name: Store the distribution packages
	uses: actions/upload-artifact@v4
	with:
	name: python-package-distributions
	path: dist/

	publish-to-pypi:
	name: Publish Python 🐍 distribution 📦 to PyPI
	if: startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes
	needs:
	- build
	runs-on: ubuntu-latest
	environment:
	name: release
	url: https://pypi.org/p/kinto-attachment
	permissions:
	id-token: write
	steps:
	- name: Download all the dists
	uses: actions/download-artifact@v4
	with:
	name: python-package-distributions
	path: dist/
	- name: Publish distribution 📦 to PyPI
	uses: pypa/gh-action-pypi-publish@release/v1

Provide feedback