action to upload to pypi

Author: externref

.github/workflows/publish.yml

@@ -1,69 +1,92 @@
-name: Build and Publish
+name: Publish to PyPI
 
 on:
   release:
     types: [published]
-  workflow_dispatch:
+  workflow_dispatch:  
+
+permissions:
+  id-token: write 
 
 jobs:
-  build:
+  build-wheels:
     name: Build wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
 
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
 
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.11'
+      - name: Install maturin
+        run: pip install maturin
 
-    - name: Set up Rust
-      uses: actions-rs/toolchain@v1
-      with:
-        toolchain: stable
-        override: true
+      - name: Build wheels
+        run: maturin build --release --out dist --find-interpreter
 
-    - name: Install maturin
-      run: pip install maturin
+      - name: Upload wheels
+        uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.os }}
+          path: dist
+
+  build-sdist:
+    name: Build source distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
 
-    - name: Build wheels
-      run: maturin build --release --out dist
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
 
-    - name: Upload wheels
-      uses: actions/upload-artifact@v4
-      with:
-        name: wheels-${{ matrix.os }}
-        path: dist/
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install maturin
+        run: pip install maturin
+
+      - name: Build sdist
+        run: maturin sdist --out dist
+
+      - name: Upload sdist
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: dist
 
   publish:
     name: Publish to PyPI
-    needs: build
+    needs: [build-wheels, build-sdist]
     runs-on: ubuntu-latest
-    if: github.event_name == 'release' && github.event.action == 'published'
-    
+    environment:
+      name: pypi
+      url: https://pypi.org/p/externkit
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
     steps:
-    - name: Download all wheels
-      uses: actions/download-artifact@v4
-      with:
-        path: dist/
-        pattern: wheels-*
-        merge-multiple: true
-
-    - name: Flatten wheels directory
-      run: |
-        mkdir -p wheels
-        find dist/ -name "*.whl" -exec cp {} wheels/ \;
-        find dist/ -name "*.tar.gz" -exec cp {} wheels/ \;
-        ls -la wheels/
-
-    - name: Publish to PyPI
-      uses: PyO3/maturin-action@v1
-      with:
-        command: upload
-        args: --skip-existing wheels/*
-      env:
-        MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: '*'
+          path: dist
+          merge-multiple: true
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          # Using trusted publishing - no API token needed!
+          # Make sure you've configured trusted publishing on PyPI:
+          # https://docs.pypi.org/trusted-publishers/
+          verbose: true