chore: update pypi publishing to use trusted

Author: cjbell

.github/workflows/publish.yml

@@ -4,31 +4,115 @@ on:
         types: [created]
 
 jobs:
-    build-n-publish:
-        name: Build and publish
-        runs-on: ubuntu-22.04
+    build:
+        name: Build distribution 📦
+        runs-on: ubuntu-latest
 
         steps:
-            - uses: actions/checkout@master
-            - name: Set up Python 3.9
-              uses: actions/setup-python@v1
+            - uses: actions/checkout@v4
+            - name: Set up Python
+              uses: actions/setup-python@v5
               with:
-                  python-version: 3.9
+                  python-version: "3.x"
             - name: Install pypa/build
               run: >-
-                  python -m
+                  python3 -m
                   pip install
                   build
                   --user
             - name: Build a binary wheel and a source tarball
-              run: >-
-                  python -m
-                  build
-                  --sdist
-                  --wheel
-                  --outdir dist/
-                  .
+              run: python3 -m build
+            - name: Store the distribution packages
+              uses: actions/upload-artifact@v4
+              with:
+                  name: python-package-distributions
+                  path: dist/
+
+    publish-to-pypi:
+        name: >-
+            Publish Python 🐍 distribution 📦 to PyPI
+        if: startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes
+        needs:
+            - build
+        runs-on: ubuntu-latest
+        environment:
+            name: pypi
+            url: https://pypi.org/p/knockapi
+        permissions:
+            id-token: write # IMPORTANT: mandatory for trusted publishing
+
+        steps:
+            - name: Download all the dists
+              uses: actions/download-artifact@v4
+              with:
+                  name: python-package-distributions
+                  path: dist/
             - name: Publish distribution 📦 to PyPI
-              uses: pypa/gh-action-pypi-publish@master
+              uses: pypa/gh-action-pypi-publish@release/v1
+
+    github-release:
+        name: >-
+            Sign the Python 🐍 distribution 📦 with Sigstore
+            and upload them to GitHub Release
+        needs:
+            - publish-to-pypi
+        runs-on: ubuntu-latest
+
+        permissions:
+            contents: write # IMPORTANT: mandatory for making GitHub Releases
+            id-token: write # IMPORTANT: mandatory for sigstore
+
+        steps:
+            - name: Download all the dists
+              uses: actions/download-artifact@v4
+              with:
+                  name: python-package-distributions
+                  path: dist/
+            - name: Sign the dists with Sigstore
+              uses: sigstore/[email protected]
+              with:
+                  inputs: >-
+                      ./dist/*.tar.gz
+                      ./dist/*.whl
+            - name: Create GitHub Release
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
+              run: >-
+                  gh release create
+                  '${{ github.ref_name }}'
+                  --repo '${{ github.repository }}'
+                  --notes ""
+            - name: Upload artifact signatures to GitHub Release
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
+              # Upload to GitHub Release using the `gh` CLI.
+              # `dist/` contains the built packages, and the
+              # sigstore-produced signatures and certificates.
+              run: >-
+                  gh release upload
+                  '${{ github.ref_name }}' dist/**
+                  --repo '${{ github.repository }}'
+
+    publish-to-testpypi:
+        name: Publish Python 🐍 distribution 📦 to TestPyPI
+        needs:
+            - build
+        runs-on: ubuntu-latest
+
+        environment:
+            name: testpypi
+            url: https://test.pypi.org/p/knockapi
+
+        permissions:
+            id-token: write # IMPORTANT: mandatory for trusted publishing
+
+        steps:
+            - name: Download all the dists
+              uses: actions/download-artifact@v4
+              with:
+                  name: python-package-distributions
+                  path: dist/
+            - name: Publish distribution 📦 to TestPyPI
+              uses: pypa/gh-action-pypi-publish@release/v1
               with:
-                  password: ${{ secrets.PYPI_API_TOKEN }}
+                  repository-url: https://test.pypi.org/legacy/