Merge branch 'master' of https://github.com/nullHawk/picard

.github/workflows/package-pypi.yml

@@ -12,7 +12,6 @@ jobs:
     runs-on: ubuntu-latest
     env:
       CODESIGN: 0
-
     steps:
     - uses: actions/checkout@v4
     - uses: actions/setup-python@v5
@@ -71,14 +70,6 @@ jobs:
       with:
         name: picard-sdist
         path: dist/*
-    - name: Publish Python distribution to PyPI
-      if: startsWith(github.ref, 'refs/tags/') && env.TWINE_PASSWORD
-      run: |
-        pip install --upgrade twine
-        twine upload --non-interactive dist/*.tar.gz
-      env:
-        TWINE_USERNAME: __token__
-        TWINE_PASSWORD: ${{ secrets.PYPI_UPLOAD_TOKEN }}
 
   pypi-bdist:
     runs-on: ${{ matrix.os }}
@@ -121,11 +112,26 @@ jobs:
       with:
         name: picard-bdist-${{ runner.os }}-${{ matrix.python-version }}
         path: dist/*.whl
-    - name: Publish Python distribution to PyPI
-      if: startsWith(github.ref, 'refs/tags/') && env.TWINE_PASSWORD
+
+  pypi-release:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    needs:
+      - pypi-bdist
+      - pypi-sdist
+    environment:
+      name: pypi
+      url: https://pypi.org/p/picard
+    permissions:
+      id-token: write  # required for PyPI upload
+    steps:
+    - uses: actions/download-artifact@v4
+      with:
+        pattern: picard-?dist*
+        path: dist/
+        merge-multiple: true
+    - name: Verify distributions
       run: |
-        pip install --upgrade twine>=3.0
-        twine upload --non-interactive dist/*
-      env:
-        TWINE_USERNAME: __token__
-        TWINE_PASSWORD: ${{ secrets.PYPI_UPLOAD_TOKEN }}
+        ls -l dist/
+    - name: Publish package distributions to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/package.yml

@@ -42,6 +42,8 @@ jobs:
     strategy:
       fail-fast: false
     secrets: inherit
+    permissions:
+      id-token: write
 
   github-release:
     runs-on: ubuntu-latest