Try out PyPI's trusted publishers (#2980)

* Create release.yml

* Update documentation

* Try out a seperate build

* Add changelog entry

* Fix formatting

* I forgot that wheels aren't .zips

* PR feedback

Co-authored-by: webknjaz < webknjaz+github/[email protected] >

---------

Co-authored-by: webknjaz <webknjaz+github/[email protected]>

.github/workflows/release.yml

@@ -0,0 +1,44 @@
+on:
+  push:
+    tags:
+      - v*
+
+# a lot of code taken from https://github.com/pypa/cibuildwheel/blob/main/examples/github-deploy.yml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.8"
+      - run: python -m pip install build
+      - run: python -m build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: trio-dist
+          path: |
+            dist/*.tar.gz
+            dist/*.whl
+
+  pypi-publish:
+    needs: [build]
+    name: upload release to PyPI
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/project/trio
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: trio-*
+          path: dist
+          merge-multiple: true
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

docs/source/releasing.rst

@@ -41,13 +41,7 @@ Things to do for releasing:
 
 * tag with vVERSION, push tag on ``python-trio/trio`` (not on your personal repository)
 
-* push to PyPI:
-
-  .. code-block::
-
-    git clean -xdf   # maybe run 'git clean -xdn' first to see what it will delete
-    python3 -m build
-    twine upload dist/*
+* approve the release workflow's publish job
 
 * update version number in the same pull request
 

newsfragments/2980.misc.rst

@@ -0,0 +1 @@
+Use PyPI's Trusted Publishers to make releases.