Experiment with trusted publishing

.github/workflows/publish-test.yml

@@ -0,0 +1,47 @@
+name: Publish to PyPI-Test
+on:
+  push:
+    tags:
+      # Only run for tags ending with `.devN`
+      # https://peps.python.org/pep-0440/#summary-of-permitted-suffixes-and-relative-ordering
+      - '*\.dev\d+'
+jobs:
+  tests:
+    uses: ./.github/workflows/tests.yml
+
+  build:
+    needs: ['tests']
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-python@v3
+        with:
+          python-version: 3.11
+
+      - run: |
+          pip install setuptools
+          python setup.py sdist
+
+      - uses: actions/upload-artifact@v3
+        with:
+          path: ./dist
+
+  # https://docs.pypi.org/trusted-publishers/using-a-publisher/
+  pypi-test-publish:
+    needs: ['build']
+    environment: 'publish'
+
+    name: upload release to PyPI-Test
+    runs-on: ubuntu-latest
+    permissions:
+      # Mandatory for trusted publishing
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v3
+
+      - name: Publish package distributions to PyPI-Test
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages_dir: artifact/
+          repository-url: https://test.pypi.org/legacy/

.github/workflows/test.yml

@@ -4,8 +4,8 @@ on:
   push:
     branches:
       - main
-
   pull_request:
+  workflow_call:  # Allow for the publish workflows to run the tests by calling this workflow
 
 jobs:
   test: