Fix publish permissions #522

	name: Build

	on:
	push:
	branches: [main]
	tags: ['v*']
	pull_request:
	branches: [main]
	workflow_dispatch:
	env:
	LATEST_PY_VERSION: '3.11'


	jobs:
	# Run unit tests for each supported python version
	test:
	runs-on: ubuntu-latest
	strategy:
	matrix:
	python-version: ['3.8', '3.9', '3.10', '3.11']
	fail-fast: false

	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: ${{ matrix.python-version }}
	- uses: snok/[email protected]
	with:
	virtualenvs-in-project: true

	# Cache packages per python version, and reuse until lockfile changes
	- name: Cache python packages
	id: cache
	uses: actions/cache@v4
	with:
	path: .venv
	key: venv-${{ matrix.python-version }}-${{ hashFiles('poetry.lock') }}
	- name: Install dependencies
	if: steps.cache.outputs.cache-hit != 'true'
	run: poetry install -v -E all

	# Run tests with coverage report
	- name: Run tests
	run: \|
	source $VENV
	nox -e cov -- xml

	# Latest python version: send coverage report to codecov
	- name: "Upload coverage report to Codecov"
	if: ${{ matrix.python-version == env.LATEST_PY_VERSION }}
	uses: codecov/codecov-action@v4


	# Run code analysis checks via pre-commit hooks
	analyze:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: ${{ env.LATEST_PY_VERSION }}
	- name: Run style checks & linting
	uses: pre-commit/[email protected]

Provide feedback