Use uv publish in "publish" CI workflow

Author: khaeru

.github/workflows/publish.yaml

@@ -1,19 +1,31 @@
 name: Build package / publish
 
 on:
-  push:
-    branches: [ main ]
-    tags: [ "v*" ]
-  release:
-    types: [ published ]
-  # Check that package can be built even on PRs
-  pull_request:
-    branches: [ main ]
+  pull_request: { branches: [ main ] }
+  push: { tags: [ "v*" ] }
+  release: { types: [ published ] }
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   publish:
-    uses: iiasa/actions/.github/workflows/publish.yaml@main
-    secrets:
-      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
-      TESTPYPI_TOKEN: ${{ secrets.TESTPYPI_TOKEN }}
+    environment: { name: publish }
+    permissions: { id-token: write }
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v6
+    - uses: astral-sh/setup-uv@v7
+      with: { python-version: "3.14" }
+    - run: uv build
+    - run: uv publish --trusted-publishing=always
+      if: >-
+        github.event_name == 'release' || (
+          github.event_name == 'push'
+          && startsWith(github.ref, 'refs/tags')
+        )
+      # Uncomment for testing
+      # env: { UV_PUBLISH_URL: "https://test.pypi.org/legacy/" }
+