Use a GH action for publishing

.github/workflows/publish.yml

@@ -12,16 +12,15 @@ on:
         default: false
         type: boolean
 
-permissions:
-  contents: write
-
 jobs:
-  publish:
+  bump: # This job is used to bump the version and create a release
     runs-on: ubuntu-latest
     env:
       VERSION: ${{ inputs.VERSION }}
       GH_TOKEN: ${{ github.token }}
       SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+    permissions:
+      contents: write
     steps:
       - name: set up Python
         uses: actions/setup-python@v4
@@ -31,7 +30,7 @@ jobs:
       - name: install dependencies
         run: |
           pip install --upgrade pip
-          pip install build twine hatch
+          pip install build hatch
 
       - name: configure git with the bot credentials
         run: |
@@ -76,23 +75,54 @@ jobs:
           --title $VERSION $PRERELEASE_FLAG
         working-directory: ./nextmv-py
 
-      - name: build binary wheel and source tarball
-        env:
-          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
+      - name: ensure passing build
         run: python -m build
         working-directory: ./nextmv-py
 
-      - name: publish to TestPyPI
-        env:
-          TWINE_USERNAME: ${{ secrets.TESTPYPI_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.TESTPYPI_PASSWORD }}
-        run: twine upload --repository testpypi dist/*
-        working-directory: ./nextmv-py
+  publish: # This job is used to publish the release to PyPI/TestPyPI
+    runs-on: ubuntu-latest
+    needs: bump
+    strategy:
+      matrix:
+        include:
+          - target-env: pypi
+            target-url: https://pypi.org/p/nextmv
+          - target-env: testpypi
+            target-url: https://test.pypi.org/p/nextmv
+    environment:
+      name: ${{ matrix.target-env }}
+      url: ${{ matrix.target-url }}
+    permissions:
+      contents: read
+      id-token: write # This is required for trusted publishing to PyPI
+    steps:
+      - name: git clone develop
+        uses: actions/checkout@v4
+        with:
+          ref: develop
 
-      - name: publish to PyPI
-        env:
-          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        run: twine upload dist/*
-        working-directory: ./nextmv-py
+      - name: set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.12"
+
+      - name: install dependencies
+        run: |
+          pip install --upgrade pip
+          pip install build hatch
+
+      - name: build binary wheel and source tarball
+        run: python -m build
+
+      - name: Publish package distributions to PyPI
+        if: ${{ matrix.target-env == 'pypi' }}
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: ./dist
+
+      - name: Publish package distributions to TestPyPI
+        if: ${{ matrix.target-env == 'testpypi' }}
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: ./dist