From e76daf6d528b9bf31bef3676818caf5450c08e94 Mon Sep 17 00:00:00 2001
From: Olly Maunder <oliver.maunder@dnv.com>
Date: Tue, 1 Sep 2026 16:10:56 +0100
Subject: [PATCH 1/2] Add a GitHub Action to publish the packages to PyPI or
 TestPyPI

---
 .github/workflows/publish.yml | 78 +++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..8c8c082
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,78 @@
+name: Build and publish packages
+
+on:
+  workflow_dispatch:
+    inputs:
+      target:
+        description: Where to publish the built packages
+        required: true
+        type: choice
+        options:
+          - testpypi
+          - pypi
+        default: testpypi
+
+jobs:
+  build:
+    name: Build packages
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Build dnv_windfarmer_client
+        working-directory: dnv_windfarmer_client
+        run: uv build
+
+      - name: Build dnv_windfarmer_sdk
+        working-directory: dnv_windfarmer_sdk
+        run: uv build
+
+      - name: Upload dnv_windfarmer_client artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dnv_windfarmer_client-dist
+          path: dnv_windfarmer_client/dist/
+
+      - name: Upload dnv_windfarmer_sdk artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dnv_windfarmer_sdk-dist
+          path: dnv_windfarmer_sdk/dist/
+
+  publish:
+    name: Publish to ${{ github.event.inputs.target }}
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: ${{ github.event.inputs.target }}
+    permissions:
+      id-token: write # required for PyPI trusted publishing
+    steps:
+      - name: Download dnv_windfarmer_client artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dnv_windfarmer_client-dist
+          path: dist
+
+      - name: Download dnv_windfarmer_sdk artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dnv_windfarmer_sdk-dist
+          path: dist
+
+      - name: Publish to TestPyPI
+        if: github.event.inputs.target == 'testpypi'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: dist
+
+      - name: Publish to PyPI
+        if: github.event.inputs.target == 'pypi'
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist

From f1df39dc578b5597814eab6bfb847cb9a3cf9605 Mon Sep 17 00:00:00 2001
From: Olly Maunder <oliver.maunder@dnv.com>
Date: Tue, 1 Sep 2026 16:39:28 +0100
Subject: [PATCH 2/2] Added a contents:read permission to the entire workflow,
 so any task can read code and artifacts.

---
 .github/workflows/publish.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8c8c082..be8f26a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,6 +12,9 @@ on:
           - pypi
         default: testpypi
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build packages