From 88da58583f328dc07127d24b2f00a2f0be3340c6 Mon Sep 17 00:00:00 2001
From: Facundo Tuesca <facundo.tuesca@trailofbits.com>
Date: Fri, 4 Oct 2024 17:05:08 +0200
Subject: [PATCH 1/2] Build packages using `uv build`

---
 {{cookiecutter.project_slug}}/.github/workflows/release.yml | 2 +-
 {{cookiecutter.project_slug}}/Makefile                      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/{{cookiecutter.project_slug}}/.github/workflows/release.yml b/{{cookiecutter.project_slug}}/.github/workflows/release.yml
index 8077036..edceb8f 100644
--- a/{{cookiecutter.project_slug}}/.github/workflows/release.yml
+++ b/{{cookiecutter.project_slug}}/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
         cache-dependency-glob: pyproject.toml
 
     - name: build
-      run: uvx --from build pyproject-build --installer uv
+      run: uv build
 
     - name: publish
       uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/{{cookiecutter.project_slug}}/Makefile b/{{cookiecutter.project_slug}}/Makefile
index d150226..bd733f0 100644
--- a/{{cookiecutter.project_slug}}/Makefile
+++ b/{{cookiecutter.project_slug}}/Makefile
@@ -91,7 +91,7 @@ doc:
 
 .PHONY: package
 package: $(VENV)/pyvenv.cfg
-	uvx --from build pyproject-build --installer uv
+	uv build
 
 .PHONY: edit
 edit:

From 38dc764f951aabf0c053f204be7bb6613df99669 Mon Sep 17 00:00:00 2001
From: Facundo Tuesca <facundo.tuesca@trailofbits.com>
Date: Fri, 4 Oct 2024 17:30:33 +0200
Subject: [PATCH 2/2] Split publish and build jobs

---
 cookiecutter.json                             |  4 +-
 .../.github/workflows/release.yml             | 41 ++++++++++++++-----
 2 files changed, 33 insertions(+), 12 deletions(-)

diff --git a/cookiecutter.json b/cookiecutter.json
index 6ba1161..4e81261 100644
--- a/cookiecutter.json
+++ b/cookiecutter.json
@@ -29,7 +29,9 @@
         "Proprietary"
     ],
     "_copy_without_render": [
-        ".github/workflows/*.yml"
+        ".github/workflows/docs.yml",
+        ".github/workflows/lint.yml",
+        ".github/workflows/tests.yml"
     ],
     "__prompts__": {
         "project_name": "Human-readable project name (translated into module slug and import)",
diff --git a/{{cookiecutter.project_slug}}/.github/workflows/release.yml b/{{cookiecutter.project_slug}}/.github/workflows/release.yml
index edceb8f..aa77ca0 100644
--- a/{{cookiecutter.project_slug}}/.github/workflows/release.yml
+++ b/{{cookiecutter.project_slug}}/.github/workflows/release.yml
@@ -5,14 +5,9 @@ on:
 
 name: release
 
-permissions:
-  # Used to sign the release's artifacts with sigstore-python.
-  # Used to publish to PyPI with Trusted Publishing.
-  id-token: write
-
 jobs:
-  pypi:
-    name: upload release to PyPI
+  build:
+    name: Build distributions
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
@@ -25,10 +20,34 @@ jobs:
         enable-cache: true
         cache-dependency-glob: pyproject.toml
 
-    - name: build
+    - name: Build distributions
       run: uv build
 
-    - name: publish
-      uses: pypa/gh-action-pypi-publish@release/v1
+    - name: Upload distributions
+      uses: actions/upload-artifact@v4
       with:
-        attestations: true
+        name: distributions
+        path: dist/
+
+  publish:
+    name: Publish Python distributions to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/{{cookiecutter.project_slug}}
+    needs: [build]
+    permissions:
+      # Used to sign the release's artifacts with sigstore-python.
+      # Used to publish to PyPI with Trusted Publishing.
+      id-token: write
+    steps:
+      - name: Download distributions
+        uses: actions/download-artifact@v4
+        with:
+          name: distributions
+          path: dist/
+
+      - name: Publish distributions
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true