ci: Use PyPI trusted publishing

.github/workflows/pypi-publish.yml

@@ -1,46 +1,50 @@
 name: Publish Python Package
 
 on:
-  push:
-    branches:
-      - main
-    tags:
-      - 'v*'
-
   workflow_dispatch:
     inputs:
-      publish:
+      publish_release:
         description: 'Create Production Release'
         required: true
         type: boolean
 
 jobs:
-  publish:
+  build:
+    name: Build distribution 📦
     runs-on: ubuntu-latest
+    outputs:
+      pkg_version: ${{ steps.semver.outputs.next }}
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4
       with:
+        persist-credentials: false
         fetch-depth: 0
-
+
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.x"
+
     - name: Get Next Version
-      if: ${{ github.event.inputs.publish }}
+      if: ${{ inputs.publish_release }}
       id: semver
       uses: ietf-tools/semver-action@v1
       with:
+        patchList: fix, bugfix, perf, refactor, test, tests, chore, revert
         token: ${{ github.token }}
         branch: main
-        
+
     - name: Set Next Version Env Var
-      if: ${{ github.event.inputs.publish }}
+      if: ${{ inputs.publish_release }}
       env:
         NEXT_VERSION: ${{ steps.semver.outputs.next }}
       run: |
         echo "NEXT_VERSION=$next" >> $GITHUB_ENV
-        
+
     - name: Create Draft Release
       uses: ncipollo/release-action@v1
-      if: ${{ github.event.inputs.publish }}
+      if: ${{ inputs.publish_release }}
       with:
         prerelease: true
         draft: false
@@ -49,86 +53,126 @@ jobs:
         name: ${{ env.NEXT_VERSION }}
         body: '*pending*'
         token: ${{ secrets.GITHUB_TOKEN }}
-    
+
     - name: Set Build Variables
       run: |
         if [[ $NEXT_VERSION ]]; then
           echo "Using AUTO SEMVER mode: $NEXT_VERSION"
-          echo "SHOULD_DEPLOY=true" >> $GITHUB_ENV
           echo "PKG_VERSION=$NEXT_VERSION" >> $GITHUB_ENV
           echo "PKG_VERSION_STRICT=${NEXT_VERSION#?}" >> $GITHUB_ENV
         elif [[ "$GITHUB_REF" =~ ^refs/tags/v* ]]; then
           echo "Using TAG mode: $GITHUB_REF_NAME"
-          echo "SHOULD_DEPLOY=true" >> $GITHUB_ENV
           echo "PKG_VERSION=$GITHUB_REF_NAME" >> $GITHUB_ENV
           echo "PKG_VERSION_STRICT=${GITHUB_REF_NAME#?}" >> $GITHUB_ENV
         else
-          echo "Using TEST mode: v2.0.0-dev.$GITHUB_RUN_NUMBER"
-          echo "SHOULD_DEPLOY=false" >> $GITHUB_ENV
-          echo "PKG_VERSION=v2.0.0-dev.$GITHUB_RUN_NUMBER" >> $GITHUB_ENV
-          echo "PKG_VERSION_STRICT=2.0.0-dev.$GITHUB_RUN_NUMBER" >> $GITHUB_ENV
+          echo "Using TEST mode: v3.0.0-dev.$GITHUB_RUN_NUMBER"
+          echo "PKG_VERSION=v3.0.0-dev.$GITHUB_RUN_NUMBER" >> $GITHUB_ENV
+          echo "PKG_VERSION_STRICT=3.0.0-dev.$GITHUB_RUN_NUMBER" >> $GITHUB_ENV
         fi
-
-    - name: Setup Python
-      uses: actions/setup-python@v2
-      with:
-        python-version: '3.x'
-
-    - name: Install Python dependencies
-      env:
-        DEBIAN_FRONTEND: noninteractive
-      run: |
-        python -m venv venv
-        source venv/bin/activate
-        python -m pip install --upgrade pip setuptools wheel twine
-        pip install build
-        sudo apt update
-        sudo apt install -y twine
-
-    - name: Build Python package
+
+    - name: Install pypa/build
+      run: >-
+        python3 -m
+        pip install
+        build
+        setuptools
+        --user
+
+    - name: Build a binary wheel and a source tarball
       run: |
         echo "Using version $PKG_VERSION_STRICT"
         sed -i -r -e "s/^__version__ = '.*'$/__version__ = '$PKG_VERSION_STRICT'/" rfc2html.py
         python ./setup.py setopt --command=metadata --option=version --set-value=$PKG_VERSION_STRICT
         python ./setup.py sdist --dist-dir dist
-
-    - name: Import Test GPG Key
-      uses: crazy-max/ghaction-import-gpg@cb4264d3319acaa2bea23d51ef67f80b4f775013
-      if: startsWith(github.ref, 'refs/tags/v') != true
-      with:
-        gpg_private_key: ${{ secrets.TEST_GPG_PRIVATE_KEY }}
-        passphrase: ${{ secrets.TEST_GPG_PASSPHRASE }}
-
-    - name: Publish to Test PyPI
-      if: env.SHOULD_DEPLOY != 'true'
-      env:
-        TWINE_USERNAME: __token__
-        TWINE_PASSWORD: ${{ secrets.TEST_PYPI_TOKEN }}
-        TWINE_REPOSITORY_URL: https://test.pypi.org/legacy/
-      run: |
-        echo "Using repository $TWINE_REPOSITORY_URL"
-        twine check dist/*
-        twine upload --verbose --sign dist/*
-
+
+    - name: Store the distribution packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+
+    - name: Store updated version
+      uses: actions/upload-artifact@v4
+      with:
+        name: rfc2html-version
+        path: rfc2html.py
+
+  publish-to-pypi:
+    name: >-
+      Publish Python 🐍 distribution 📦 to PyPI
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/p/rfc2html
+    permissions:
+      id-token: write
+    if: ${{ inputs.publish_release }}
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+
+    - name: Publish distribution 📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+
+  github-release:
+    name: >-
+      Sign the Python 🐍 distribution 📦 with Sigstore
+      and upload them to GitHub Release
+    needs:
+    - build
+    - publish-to-pypi
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      id-token: write
+      packages: write
+      pull-requests: write
+
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+
+    - name: Download updated version file
+      uses: actions/download-artifact@v4
+      with:
+        name: rfc2html-version
+        path: ./
+        merge-multiple: true
+
+    - name: Set Variables
+      run: echo "PKG_VERSION=${{needs.build.outputs.pkg_version}}" >> $GITHUB_ENV
+
     - name: Update CHANGELOG
       id: changelog
       uses: Requarks/changelog-action@v1
-      if: env.SHOULD_DEPLOY == 'true'
       with:
         token: ${{ github.token }}
         tag: ${{ env.PKG_VERSION }}
+        excludeTypes: ''
 
-    - name: Commit CHANGELOG.md
-      uses: stefanzweifel/git-auto-commit-action@v4
-      if: env.SHOULD_DEPLOY == 'true'
+    - name: Sign the dists with Sigstore
+      uses: sigstore/gh-action-sigstore-python@v3.0.0
       with:
-        branch: main
-        commit_message: 'docs: update CHANGELOG.md + py files for ${{ env.PKG_VERSION }} [skip ci]'
-        file_pattern: CHANGELOG.md setup.cfg rfc2html.py
-        
+        inputs: >-
+          ./dist/*.tar.gz
+          ./dist/*.whl
+
     - name: Create Release
       uses: ncipollo/release-action@v1
-      if: env.SHOULD_DEPLOY == 'true'
       with:
         allowUpdates: true
         draft: false
@@ -137,12 +181,32 @@ jobs:
         body: ${{ steps.changelog.outputs.changes }}
         artifacts: "dist/**"
         token: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Upload Build Artifacts
-      uses: actions/upload-artifact@v2.3.1
-      with:
-        name: artifacts
-        path: |
-          CHANGELOG.md
-          rfc2html.py
-          setup.cfg
+        makeLatest: true
+
+    - name: Create Pull Request
+      uses: peter-evans/create-pull-request@v7
+      with:
+        commit_message: 'docs: update CHANGELOG.md + py file versions for ${{ env.PKG_VERSION }} [skip ci]'
+
+  publish-to-testpypi:
+    name: Publish Python 🐍 distribution 📦 to TestPyPI
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://test.pypi.org/p/rfc2html
+    permissions:
+      id-token: write
+
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+
+    - name: Publish distribution 📦 to TestPyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: https://test.pypi.org/legacy/