Pivot to gha for wheel builds and pypi trusted publishers

.github/workflows/wheels.yml

@@ -5,9 +5,76 @@ on:
     tags:
       - '*'
 jobs:
+  build_wheels:
+    name: Build wheels
+    runs-on: ${{ matrix.os }}
+    environment: release
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-11, windows-latest]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        name: Install Python
+        with:
+          python-version: '3.10'
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v2.13.0
+      - uses: actions/upload-artifact@v3
+        with:
+          path: ./wheelhouse/*.whl
+          name: shared-wheel-builds
+  build_wheels_macos_arm:
+    name: Build wheels on macOS arm
+    runs-on: ${{ matrix.os }}
+    environment: release
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-11]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        name: Install Python
+        with:
+          python-version: '3.10'
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v2.13.0
+        env:
+          CIBW_BEFORE_ALL: rustup target add aarch64-apple-darwin
+          CIBW_ARCHS_MACOS: arm64 universal2
+          CIBW_ENVIRONMENT: >-
+            CARGO_BUILD_TARGET="aarch64-apple-darwin"
+            PYO3_CROSS_LIB_DIR="/Library/Frameworks/Python.framework/Versions/$(python -c 'import sys; print(str(sys.version_info[0])+"."+str(sys.version_info[1]))')/lib/python$(python -c 'import sys; print(str(sys.version_info[0])+"."+str(sys.version_info[1]))')"
+      - uses: actions/upload-artifact@v3
+        with:
+          path: ./wheelhouse/*.whl
+          name: shared-wheel-builds
+  upload_shared_wheels:
+    name: Upload shared build wheels
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
+    needs: ["build_wheels", "build_wheels_macos_arm"]
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: shared-wheel-builds
+          path: deploy
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: deploy
   build_wheels_s390x:
     name: Build wheels on s390x
     runs-on: ${{ matrix.os }}
+    environment: release
+    permissions:
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -31,16 +98,16 @@ jobs:
       - uses: actions/upload-artifact@v3
         with:
           path: ./wheelhouse/*.whl
-      - name: Install twine
-        run: python -m pip install twine
-      - name: Upload to PyPI
-        run: twine upload ./wheelhouse/*.whl
-        env:
-          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
-          TWINE_USERNAME: qiskit
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: wheelhouse/
   build_wheels_ppc64le:
     name: Build wheels on ppc64le
     runs-on: ${{ matrix.os }}
+    environment: release
+    permissions:
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -64,16 +131,16 @@ jobs:
       - uses: actions/upload-artifact@v3
         with:
           path: ./wheelhouse/*.whl
-      - name: Install twine
-        run: python -m pip install twine
-      - name: Upload to PyPI
-        run: twine upload ./wheelhouse/*.whl
-        env:
-          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
-          TWINE_USERNAME: qiskit
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: wheelhouse/
   build_wheels_aarch64:
     name: Build wheels on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
+    environment: release
+    permissions:
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -96,10 +163,58 @@ jobs:
       - uses: actions/upload-artifact@v3
         with:
           path: ./wheelhouse/*.whl
-      - name: Install twine
-        run: python -m pip install twine
-      - name: Upload to PyPI
-        run: twine upload ./wheelhouse/*.whl
-        env:
-          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
-          TWINE_USERNAME: qiskit
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: wheelhouse/
+  sdist:
+    name: Build and publish terra sdist
+    runs-on: ${{ matrix.os }}
+    needs: ["upload_shared_wheels"]
+    environment: release
+    permissions:
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        name: Install Python
+        with:
+          python-version: '3.10'
+      - name: Install deps
+        run: pip install -U twine setuptools-rust wheel build
+      - name: Build sdist
+        run: python -m build . --sdist
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+  metapackage:
+    name: Build and publish terra sdist
+    runs-on: ${{ matrix.os }}
+    needs: ["sdist"]
+    environment: release
+    permissions:
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
+        name: Install Python
+        with:
+          python-version: '3.10'
+      - name: Install deps
+        run: pip install -U twine setuptools-rust wheel build
+      - name: Build packages
+        run: |
+          set -e
+          cd qiskit_pkg
+          python -m build .
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: qiskit_pkg/dist

azure-pipelines.yml

@@ -9,9 +9,6 @@ trigger:
       - 'main'
       - 'stable/*'
       - 'gh-readonly-queue/*'
-  tags:
-    include:
-      - '*'
 
 pr:
   autoCancel: true
@@ -218,83 +215,3 @@ stages:
             testQPY: true
             testImages: true
             installOptionals: false
-
-  # Push to a tag.  The triggering tags are set in the triggers at the top of
-  # this file.
-  - ${{ if and(eq(variables['Build.Reason'], 'IndividualCI'), startsWith(variables['Build.SourceBranch'], 'refs/tags/')) }}:
-    - stage: "Deploy"
-      jobs:
-        - template: ".azure/wheels.yml"
-          parameters:
-            jobName: "linux"
-            pool: {vmImage: 'ubuntu-latest'}
-
-        - template: ".azure/wheels.yml"
-          parameters:
-            jobName: "macos"
-            pool: {vmImage: 'macOS-11'}
-
-        - template: ".azure/wheels.yml"
-          parameters:
-            jobName: "macos_arm"
-            pool: {vmImage: 'macOS-11'}
-            env:
-              CIBW_BEFORE_ALL: rustup target add aarch64-apple-darwin
-              CIBW_ARCHS_MACOS: arm64 universal2
-              CIBW_ENVIRONMENT: >-
-                CARGO_BUILD_TARGET="aarch64-apple-darwin"
-                PYO3_CROSS_LIB_DIR="/Library/Frameworks/Python.framework/Versions/$(python -c 'import sys; print(str(sys.version_info[0])+"."+str(sys.version_info[1]))')/lib/python$(python -c 'import sys; print(str(sys.version_info[0])+"."+str(sys.version_info[1]))')"
-
-        - template: ".azure/wheels.yml"
-          parameters:
-            jobName: "windows"
-            pool: {vmImage: 'windows-latest'}
-            setupPython:
-              - ${{ each version in parameters.supportedPythonVersions }}:
-                - task: UsePythonVersion@0
-                  inputs:
-                    versionSpec: ${{ version }}
-                    architecture: x86
-                - task: UsePythonVersion@0
-                  inputs:
-                    versionSpec: ${{ version }}
-                    architecture: x64
-    - stage: "sdist"
-      dependsOn: "Deploy"
-      jobs:
-        - job: 'sdist'
-          pool: {vmImage: 'ubuntu-latest'}
-          steps:
-            - task: UsePythonVersion@0
-            - bash: |
-                set -e
-                python -m pip install --upgrade pip
-                python -m pip install --upgrade setuptools_rust
-                python setup.py sdist
-            - task: PublishBuildArtifacts@1
-              inputs: {pathtoPublish: 'dist'}
-              condition: succeededOrFailed()
-            - bash: |
-                python -m pip install --upgrade twine
-                twine upload dist/*
-              env:
-                TWINE_USERNAME: "qiskit"
-                TWINE_PASSWORD: $(TWINE_PASSWORD)
-        - job: 'qiskit_pkg'
-          pool: {vmImage: 'ubuntu-latest'}
-          steps:
-            - task: UsePythonVersion@0
-            - bash: |
-                set -e
-                python -m pip install --upgrade pip build
-                cd qiskit_pkg
-                python -m build .
-            - task: PublishBuildArtifacts@1
-              inputs: {pathtoPublish: 'qiskit_pkg/dist'}
-              condition: succeededOrFailed()
-            - bash: |
-                python -m pip install --upgrade twine
-                twine upload qiskit_pkg/dist/*
-              env:
-                TWINE_USERNAME: "qiskit"
-                TWINE_PASSWORD: $(TWINE_PASSWORD)