Update deploy workflow to be manual and require approvals

Author: nicoddemus

.github/workflows/deploy.yml

@@ -1,14 +1,23 @@
 name: deploy
 
 on:
-  push:
-    tags:
-      - "[0-9]+.[0-9]+.[0-9]+"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version'
+        required: true
+        default: '1.2.3'
 
 jobs:
 
   deploy:
     runs-on: ubuntu-latest
+    environment: deploy
+    permissions:
+      id-token: write  # For PyPI trusted publishers.
+      contents: write  # For tag and release notes.
+    env:
+      SETUPTOOLS_SCM_PRETEND_VERSION: ${{ github.event.inputs.version }}
 
     steps:
     - uses: actions/checkout@v3
@@ -23,12 +32,8 @@ jobs:
         path: dist
 
     - name: Publish package to PyPI
-      uses: pypa/gh-action-pypi-publish@master
-      with:
-        user: __token__
-        password: ${{ secrets.pypi_token }}
+      uses: pypa/[email protected]
 
-    - name: Set up Python
-      uses: actions/[email protected]
+    - uses: actions-ecosystem/action-push-tag@v1
       with:
-        python-version: "3.10"
+        tag: ${{ github.event.inputs.version }}

HOWTORELEASE.rst

@@ -0,0 +1,7 @@
+Here are the steps on how to make a new release.
+
+1. Create a ``release-VERSION`` branch from ``upstream/main``.
+2. Update ``CHANGELOG.rst``.
+3. Push the branch to ``upstream``.
+4. Once all tests pass, start the ``deploy`` workflow manually.
+5. Merge the PR.