Try out PyPI's trusted publishers

.github/workflows/release.yml

@@ -0,0 +1,44 @@
+on:
+  label:
+    types: [created]
+
+# a lot of code taken from https://github.com/pypa/cibuildwheel/blob/main/examples/github-deploy.yml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.8"
+      - run: python -m pip install build
+      - run: python -m build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: trio-sdist
+          path: dist/*.tar.gz
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: trio-wheel
+          path: dist/*.whl
+
+  pypi-publish:
+    needs: [build]
+    name: upload release to PyPI
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: trio-*
+          path: dist
+          merge-multiple: true
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

docs/source/releasing.rst

@@ -41,11 +41,7 @@ Things to do for releasing:
 
 * tag with vVERSION, push tag on ``python-trio/trio`` (not on your personal repository)
 
-* push to PyPI::
-
-    git clean -xdf   # maybe run 'git clean -xdn' first to see what it will delete
-    python3 -m build
-    twine upload dist/*
+* approve the release workflow
 
 * update version number in the same pull request
 

newsfragments/2980.misc.rst

@@ -0,0 +1 @@
+Use PyPI's Trusted Publishers to make releases.