Merge pull request #32 from nens/eli-use-trusted-publishing

update action versions, use trusted publishing

.github/workflows/lint.yaml

@@ -13,12 +13,12 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 
       - name: Run black, flake8, isort
-        uses: pre-commit/[email protected].0
+        uses: pre-commit/[email protected].1

.github/workflows/release.yml

@@ -22,10 +22,10 @@ jobs:
 
     steps:
       - name: Checkout source
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.10"
 
@@ -34,19 +34,19 @@ jobs:
           python -m pip install build
           python -m build
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           path: ./dist/*
           retention-days: 5
 
-  publish:
-    name: Publish on GitHub and PyPI
+  github-publish:
+    name: Publish on GitHub
     needs: [build]
     runs-on: ubuntu-latest
     # release on every tag
     if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/')
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           name: artifact
           path: dist
@@ -55,7 +55,22 @@ jobs:
         id: upload-release-asset
         uses: softprops/action-gh-release@v2
 
-      - name: Upload Release Assets to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+  pypi-publish:
+    name: Publish on PyPI
+    needs: [build, github-publish]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/threedi-urban-eia-nl
+    # release on every tag
+    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/')
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+    steps:
+      - uses: actions/download-artifact@v4
         with:
-          password: ${{ secrets.PYPI_UPLOAD_TOKEN }}
+          name: artifact
+          path: dist
+
+      - name: Upload Release Assets to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1