- Move token lookup into scripts/pypi_token.sh, shared by both recipes
- Resolve UV_PUBLISH_TOKEN, then .env, then pass api/packages/pypi
- Fail with a clear hint instead of dropping into an interactive prompt
- Never print the token, only its length
- Gate publish behind version-check so version drift stops the build
- Add publish-dry, same path as publish but with uv publish --dry-run
- Pass --check-url so re-runs skip files already on PyPI
- Hoist dist dir, token entry, and check URL into justfile variables
- Add .env and .env.* to .gitignore
The old recipe sourced .env for credentials, but .env was never ignored, so a token file dropped there would have been committed and shipped inside the sdist.
Verified token precedence for env, .env and password-store, the missing-token exit code, the version-check gate, and a dry run against an unpublished version.
