From 7106e35c21162b9aec79769effd823d9b79320b5 Mon Sep 17 00:00:00 2001
From: Uriah Finkel <Ufinkel@gmail.com>
Date: Wed, 12 Aug 2026 14:16:45 +0300
Subject: [PATCH 1/3] Gate trusted publishing behind release marker

---
 .github/workflows/python-package.yml | 55 ++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/.github/workflows/python-package.yml b/.github/workflows/python-package.yml
index 9abd6c05..32f56f6a 100644
--- a/.github/workflows/python-package.yml
+++ b/.github/workflows/python-package.yml
@@ -36,3 +36,58 @@ jobs:
 
       - name: Show package version
         run: grep -r "version" pyproject.toml || grep -r "__version__" rtichoke/ || python -c "import rtichoke; print(rtichoke.__version__)"
+
+  release:
+    if: github.event_name == 'push'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Check for intentional release marker change
+        id: marker
+        shell: bash
+        run: |
+          if git diff --name-only HEAD^ HEAD | grep -qx '.github/release-version'; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Install uv
+        if: steps.marker.outputs.changed == 'true'
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.10"
+
+      - name: Validate release version
+        if: steps.marker.outputs.changed == 'true'
+        id: version
+        shell: bash
+        run: |
+          RELEASE_VERSION=$(tr -d '[:space:]' < .github/release-version)
+          PACKAGE_VERSION=$(sed -n 's/^version = "\([^"]*\)"/\1/p' pyproject.toml | head -n 1)
+          test -n "$RELEASE_VERSION"
+          test "$RELEASE_VERSION" = "$PACKAGE_VERSION"
+          echo "version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Build package
+        if: steps.marker.outputs.changed == 'true'
+        run: uv build
+
+      - name: Publish to PyPI
+        if: steps.marker.outputs.changed == 'true'
+        run: uv publish
+
+      - name: Create GitHub release
+        if: steps.marker.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: gh release create "v${VERSION}" --target "${GITHUB_SHA}" --generate-notes --title "v${VERSION}"

From efef0bba3c9e0ea95613e072397831ebadd128fb Mon Sep 17 00:00:00 2001
From: Uriah Finkel <Ufinkel@gmail.com>
Date: Wed, 12 Aug 2026 14:16:55 +0300
Subject: [PATCH 2/3] Mark release 0.1.29

---
 .github/release-version | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .github/release-version

diff --git a/.github/release-version b/.github/release-version
new file mode 100644
index 00000000..5ef49d2f
--- /dev/null
+++ b/.github/release-version
@@ -0,0 +1 @@
+0.1.29

From 93ff2683c03c82f1a8f38302887d8cef3caa4a1d Mon Sep 17 00:00:00 2001
From: Uriah Finkel <Ufinkel@gmail.com>
Date: Wed, 12 Aug 2026 14:17:09 +0300
Subject: [PATCH 3/3] Remove mismatched release workflow

---
 .github/workflows/release.yml | 43 -----------------------------------
 1 file changed, 43 deletions(-)
 delete mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 4245c737..00000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,43 +0,0 @@
-name: Release package
-
-on:
-  push:
-    branches: ["main"]
-    paths:
-      - "pyproject.toml"
-      - ".github/workflows/release.yml"
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v5
-        with:
-          python-version: "3.10"
-
-      - name: Read package version
-        id: version
-        shell: bash
-        run: |
-          VERSION=$(sed -n 's/^version = "\([^"]*\)"/\1/p' pyproject.toml | head -n 1)
-          test -n "$VERSION"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Build package
-        run: uv build
-
-      - name: Publish to PyPI
-        run: uv publish
-
-      - name: Create GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: gh release create "v${VERSION}" --target "${GITHUB_SHA}" --generate-notes --title "v${VERSION}"