CI: Add trusted publishing for PyPI and TestPyPI

Author: Puerling

.github/workflows/build_wheel.yml

@@ -89,3 +89,59 @@ jobs:
           with state.State(quiet=False) as p_state:
             pass
           EOF
+
+  deploy-testpypi:
+    name: Deploy to TestPyPI
+    if: github.ref == 'refs/heads/develop'
+    needs: ['build_wheels', 'install_wheels']
+    environment: 'publish-testpypi'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: cibw-wheels-ubuntu-latest
+          path: dist
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: cibw-wheels-macos-latest
+          path: dist
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: cibw-wheels-windows-latest
+          path: dist
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  deploy-pypi:
+    name: Deploy to PyPI
+    if: github.ref == 'refs/heads/master'
+    needs: ['build_wheels', 'install_wheels']
+    environment: 'publish-pypi'
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: cibw-wheels-ubuntu-latest
+          path: dist
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: cibw-wheels-macos-latest
+          path: dist
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: cibw-wheels-windows-latest
+          path: dist
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/ci.yml

@@ -774,107 +774,6 @@ jobs:
         path: ui-cpp/ui-imgui/webapp/
         if-no-files-found: error
 
-  build-pypi:
-    if: github.event_name != 'pull_request'
-    needs:
-      - lint
-      - test-gcc
-      - test-clang
-      - test-nvcpp
-      - test-msvc
-      - test-debug
-      - test-coverage
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux
-            os: ubuntu-latest
-          - platform: macos
-            os: macos-latest
-          - platform: windows
-            os: windows-latest
-    env:
-      BUILD_TYPE: Release
-      CMAKE_FLAGS: -DSPIRIT_UI_USE_IMGUI=OFF -DSPIRIT_UI_CXX_USE_QT=OFF
-      SPIRIT_ADD_VERSION_SUFFIX: true
-
-    steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-
-    - name: ⚙ Configure environment
-      shell: bash
-      if: github.ref == 'refs/heads/master'
-      run: echo "SPIRIT_ADD_VERSION_SUFFIX=false" >> $GITHUB_ENV
-
-    - name: 📁 Create build folder
-      run: cmake -E make_directory ${{runner.workspace}}/build
-
-    - name: ⚙ Configure
-      shell: bash
-      working-directory: ${{runner.workspace}}/build
-      run: cmake $GITHUB_WORKSPACE -DCMAKE_BUILD_TYPE=$BUILD_TYPE $CMAKE_FLAGS
-
-    - name: 🛠 Build
-      shell: bash
-      working-directory: ${{runner.workspace}}/build
-      run: cmake --build . --config $BUILD_TYPE -j 2
-
-    - name: 📚 Install necessary packages
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install numpy setuptools wheel twine
-
-    - name: 🛠 Build Python package
-      shell: bash
-      working-directory: ./core/python
-      run: |
-        echo "Python package build"
-        echo "Add suffix to spirit version tag for python package $SPIRIT_ADD_VERSION_SUFFIX"
-        python setup.py sdist bdist_wheel
-
-    - uses: actions/upload-artifact@v4
-      with:
-        name: dist-${{ matrix.platform }}
-        path: ./core/python/dist
-        if-no-files-found: error
-
-  deploy-pypi:
-    if: github.event_name != 'pull_request'
-    needs: ['build-pypi']
-    environment: 'publish'
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-
-    steps:
-      - uses: actions/download-artifact@v4
-
-      - name: 📚 Install necessary packages
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install twine
-
-      - name: 🚀 Deploy to TestPyPI
-        env:
-          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        if: github.ref != 'refs/heads/master'
-        run: twine upload --skip-existing --repository testpypi dist/*
-
-      - name: 🚀 Deploy to PyPI
-        env:
-          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        if: github.ref == 'refs/heads/master'
-        run: twine upload --skip-existing dist/*
-
   deploy-package:
     if: github.event_name != 'pull_request'
     needs:
@@ -950,7 +849,7 @@ jobs:
 
   draft-release:
     if: github.event_name == 'push' && startsWith( github.ref, 'refs/tags/' )
-    needs: [deploy-pypi, deploy-package, build-webapp]
+    needs: [deploy-package, build-webapp]
     runs-on: ubuntu-latest
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}