Configure trusted publishing to PyPi

Author: berendkleinhaneveld

.github/workflows/ci.yml

@@ -75,34 +75,27 @@ jobs:
     runs-on: ubuntu-latest
     needs: [test, build]
     if: success() && startsWith(github.ref, 'refs/tags/v')
+    environment:
+      name: pypi
+      url: https://pypi.org/p/patchdiff
+    permissions:
+      id-token: write
+      contents: write
     steps:
     - uses: actions/checkout@v5
     - name: Download wheel artifact
       uses: actions/download-artifact@v4
       with:
         name: dist
         path: dist
-    - name: Get version from git ref
-      id: get_version
-      run: echo ::set-output name=VERSION::${GITHUB_REF/refs\/tags\//}
-    - name: Create GH release
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    - name: Release
+      uses: softprops/action-gh-release@v2
       with:
-        tag_name: ${{ steps.get_version.outputs.VERSION }}
-        release_name: Release ${{ steps.get_version.outputs.VERSION }}
-        draft: false
+        token: ${{ secrets.GITHUB_TOKEN }}
+        files: |
+          dist/*.tar.gz
+          dist/*.whl
+        draft: true
         prerelease: false
-    - name: Upload release assets
-      # Move back to official action after fix https://github.com/actions/upload-release-asset/issues/4
-      uses: AButler/[email protected]
-      with:
-        release-tag: ${{ steps.get_version.outputs.VERSION }}
-        files: 'dist/*.tar.gz;dist/*.whl'
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Publish to PyPI
-      uses: pypa/gh-action-pypi-publish@master
-      with:
-        user: __token__
-        password: ${{ secrets.PYPI_PASSWORD }}
+      uses: pypa/gh-action-pypi-publish@release/v1