INTPYTHON-410 Set up trusted publishing (#169) #1

	name: Python Wheels

	on:
	push:
	branches: ["main"]
	tags:
	- "**"
	pull_request:
	workflow_dispatch:

	concurrency:
	group: wheels-${{ github.ref }}
	cancel-in-progress: true

	defaults:
	run:
	shell: bash -eux {0}

	jobs:

	build_dist:
	name: Build Distribution Files
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	persist-credentials: false

	- uses: actions/setup-python@v5
	with:
	# Build sdist on lowest supported Python
	python-version: '3.9'

	- name: Install build
	run: \|
	python -m pip install build

	- name: build the dist files
	run: \|
	python -m build .

	- name: Upload the dist files
	uses: actions/upload-artifact@v4
	with:
	name: dist-${{ github.run_id }}
	path: ./dist/.

	publish:
	# https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#publishing-the-distribution-to-pypi
	needs: [build_dist]
	if: startsWith(github.ref, 'refs/tags/')
	runs-on: ubuntu-latest
	environment: release
	permissions:
	id-token: write
	steps:
	- name: Download the dists
	uses: actions/download-artifact@v4
	with:
	name: dist-${{ github.run_id }}
	path: dist/
	- name: Publish distribution 📦 to PyPI
	uses: pypa/gh-action-pypi-publish@release/v1
	with:
	repository-url: https://test.pypi.org/legacy/

Provide feedback