Setup trusted publish

Author: penguinolog

.github/workflows/pythonpackage.yml

@@ -121,26 +121,42 @@ jobs:
           py.test --cov-report= --cov=logwrap test
           coverage report -m --fail-under 85
 
+  Build:
+    needs: [ Test ]
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.x'
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install --upgrade twine build
+      - name: Build package
+        run: |
+          python -m build
+      - uses: actions/upload-artifact@v3
+        with:
+          path: dist/*
+
   Deploy:
-      needs: [Test]
+      needs: [Build]
       if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
       runs-on: ubuntu-latest
+      environment:
+        name: pypi
+        url: https://pypi.org/p/logwrap
+      permissions:
+        id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
       steps:
-        - uses: actions/checkout@v3
-        - name: Set up Python
-          uses: actions/setup-python@v4
+        - uses: actions/download-artifact@v3
           with:
-            python-version: '3.x'
-        - name: Install dependencies
-          run: |
-            python -m pip install --upgrade pip
-            pip install --upgrade twine build
-        - name: Build package
-          run: |
-            python -m build
-        - name: Deploy
-          env:
-            TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-            TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-          run: |
-            twine upload --skip-existing dist/*
+            # unpacks default artifact into dist/
+            # if `name: artifact` is omitted, the action will create extra parent dir
+            name: artifact
+            path: dist
+        - name: Publish package distributions to PyPI
+          uses: pypa/gh-action-pypi-publish@release/v1