MNT: update PyPI publication automation for trusted publishers

.github/workflows/test.yml

@@ -140,42 +140,54 @@ jobs:
         python-version: 3.x
     - run: pipx run check-manifest
 
-  check-twine:
-    name: Test deployment
+  build-artifacts:
+    name: Build artifacts
     runs-on: ubuntu-latest
 
-    concurrency:
-      group: ${{ github.ref }}-check_twine
-      cancel-in-progress: true
-
     steps:
     - uses: actions/checkout@v4
     - uses: actions/setup-python@v5
       with:
         python-version: 3.x
     - run: |
-        pipx run build --sdist --wheel
+        pipx run build
         pipx run twine check dist/*
 
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v3
+      with:
+        name: dist
+        path: dist
+
   publish:
     name: Publish to PyPI
-    runs-on: ubuntu-latest
+
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     needs:
     - build
-    - check-manifest
-    - check-twine
-    - docs
     - type-check
+    - docs
+    - check-manifest
+    - build-artifacts
+
+    runs-on: ubuntu-latest
+    environment:
+      url: https://pypi.org/p/CMasher
+
+    permissions:
+      id-token: write
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - name: Checkout Source
+      uses: actions/checkout@v4
+    - name: Setup Python
+      uses: actions/setup-python@v5
       with:
         python-version: 3.x
-    - name: Deploy package
-      if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
-      env:
-        TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-      run: |
-        pipx run build --sdist --wheel
-        pipx run twine upload dist/*
+
+    - name: Build distributions
+      shell: bash -l {0}
+      run: pipx run build
+
+    - name: Publish package distributions to PyPI
+      if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+      uses: pypa/gh-action-pypi-publish@release/v1