simplify PyPI publihsing

Author: dimitri-yatsenko

.github/workflows/publish-to-pypi.yml

@@ -7,33 +7,33 @@ on:
   workflow_dispatch:
 
 jobs:
-  publish:
+  dist:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          fetch-depth: 0
 
-      - name: Install build tooling
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install build twine
+      - name: Build and inspect package
+        uses: hynek/build-and-inspect-python-package@v2
+
+  publish:
+    needs: dist
+    runs-on: ubuntu-latest
+    if: github.event_name == 'release' && github.event.action == 'published'
 
-      - name: Build artifacts
-        run: python -m build
+    steps:
+      - name: Download built artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
 
       - name: Configure publish credentials
         id: publish-config
         env:
-          EVENT_NAME: ${{ github.event_name }}
           RELEASE_NAME: ${{ github.event.release.name }}
           DEFAULT_USERNAME: ${{ secrets.twine_username }}
           DEFAULT_PASSWORD: ${{ secrets.twine_password }}
@@ -46,16 +46,14 @@ jobs:
           username="$DEFAULT_USERNAME"
           password="$DEFAULT_PASSWORD"
 
-          if [[ "${EVENT_NAME}" == "release" && -n "${RELEASE_NAME}" ]]; then
-            if [[ "${RELEASE_NAME}" =~ ^[Tt]est ]]; then
-              if [[ -z "${TEST_USERNAME}" || -z "${TEST_PASSWORD}" ]]; then
-                echo "::error::Test PyPI credentials are required for releases starting with 'Test'"
-                exit 1
-              fi
-              repository="testpypi"
-              username="$TEST_USERNAME"
-              password="$TEST_PASSWORD"
+          if [[ -n "${RELEASE_NAME}" && "${RELEASE_NAME}" =~ ^[Tt]est ]]; then
+            if [[ -z "${TEST_USERNAME}" || -z "${TEST_PASSWORD}" ]]; then
+              echo "::error::Test PyPI credentials are required for releases starting with 'Test'"
+              exit 1
             fi
+            repository="testpypi"
+            username="$TEST_USERNAME"
+            password="$TEST_PASSWORD"
           fi
 
           if [[ -z "${username}" || -z "${password}" ]]; then
@@ -69,10 +67,12 @@ jobs:
             echo "password=${password}"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Publish distribution to PyPI
+      - name: Publish distribution
         env:
           TWINE_USERNAME: ${{ steps.publish-config.outputs.username }}
           TWINE_PASSWORD: ${{ steps.publish-config.outputs.password }}
           TWINE_REPOSITORY: ${{ steps.publish-config.outputs.repository }}
         run: |
+          python -m pip install --upgrade pip
+          python -m pip install twine
           twine upload --repository "${TWINE_REPOSITORY}" dist/*