From 652a142e86a05f38d37e8ea24368c9d6d2336411 Mon Sep 17 00:00:00 2001
From: snowy-yang <102860110+snowy-yang@users.noreply.github.com>
Date: Sat, 3 Oct 2026 19:12:11 +0800
Subject: [PATCH] =?UTF-8?q?ci:=20=E5=8A=A0=E5=B9=B6=E5=8F=91=E5=8F=96?=
 =?UTF-8?q?=E6=B6=88=E4=B8=8E=E6=9E=84=E5=BB=BA=20job=EF=BC=8C=E6=96=B0?=
 =?UTF-8?q?=E5=A2=9E=20tag=20=E8=A7=A6=E5=8F=91=E7=9A=84=20PyPI=20?=
 =?UTF-8?q?=E5=8F=91=E5=B8=83=E5=B7=A5=E4=BD=9C=E6=B5=81=EF=BC=88Trusted?=
 =?UTF-8?q?=20Publishing=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/ci.yml      | 25 +++++++++++++++++++++++++
 .github/workflows/publish.yml | 31 +++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f21a3e6..dd0fa42 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,10 @@ on:
   pull_request:
   workflow_dispatch:
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint:
     name: ruff + pyright + pytest
@@ -37,3 +41,24 @@ jobs:
 
       - name: pytest 单元测试
         run: uv run pytest
+
+  build:
+    name: 构建发行包
+    runs-on: ubuntu-latest
+    steps:
+      - name: 检出代码
+        uses: actions/checkout@v4
+
+      - name: 安装 uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: 构建 sdist 与 wheel
+        run: uv build
+
+      - name: 上传构建产物
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..9a10087
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,31 @@
+name: 发布到 PyPI
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    name: 构建并发布
+    runs-on: ubuntu-latest
+    permissions:
+      # Trusted Publishing（OIDC）需要显式声明 id-token 写权限
+      id-token: write
+    steps:
+      - name: 检出代码
+        uses: actions/checkout@v4
+
+      - name: 安装 uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: 构建 sdist 与 wheel
+        run: uv build
+
+      # 走 Trusted Publishing：无 token，发布身份由 GitHub OIDC 签发。
+      # 前置条件（一次性）：pypi.org → qqbotsdk-py → Publishing →
+      # Add pending publisher（owner: snowy-yang，repo: qqbotsdk，
+      # workflow: publish.yml）
+      - name: 发布
+        run: uv publish