Update GitHub Actions workflow for PyPI publishing

Author: ccaprani

.github/workflows/publish.yml

@@ -1,52 +1,49 @@
-name: Build and deploy
+name: Publish to PyPI
 
 on:
   workflow_dispatch:
-#  push:
-#    # Sequence of patterns matched against refs/tags
-#    tags:
-#      - '[0-9]+.[0-9]+.[0-9]+' # Push events to any matching semantic tag. For example, 1.10.1 or 2.0.0.
   release:
-    types:
-      - published
+    types: [published]
 
 jobs:
-  dist:
+  build:
+    name: Build distribution
     runs-on: ubuntu-latest
+
     steps:
-    - uses: actions/checkout@v1
+      - uses: actions/checkout@v4
 
-    - name: Build wheel and SDist
-      run: pipx run build
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
 
-    - uses: actions/upload-artifact@v4
-      with:
-        path: dist/*
+      - name: Install build
+        run: pip install build
 
-    - name: Check metadata
-      run: pipx run twine check dist/*
+      - name: Build sdist and wheel
+        run: python -m build
 
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
 
   publish:
-    needs: [dist]
+    name: Publish to PyPI
+    needs: build
     runs-on: ubuntu-latest
-    # upload to PyPI on every tag starting with 'v'
-    # if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v')
-    # alternatively, to publish when a GitHub Release is created, use the following rule:
-    if: (github.event_name == 'release' && github.event.action == 'published') || github.event_name == 'workflow_dispatch'
+    environment: release
+    permissions:
+      id-token: write   # required for OIDC trusted publishing
 
     steps:
-    - uses: actions/download-artifact@v4
-      with:
-        name: artifact
-        path: dist
-
-    - name: Publish distribution 📦 to PyPI
-      uses: pypa/gh-action-pypi-publish@v1.9.0
-      with:
-        password: ${{ secrets.PYPI_API_TOKEN_PYCBA }}
-        # remove following once testing complete
-        # user: __token__
-        # password: ${{ secrets.TEST_PYPI_API_TOKEN_PYCBA }}
-        # repository_url: https://test.pypi.org/legacy/
-
+      - name: Download dist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1