ci: switch to PyPI's trusted publishing #44

	name: Continuous Integration

	on:
	push:
	pull_request:
	branches: [ main ]
	release:
	types: [published]

	jobs:

	test:

	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v4
	- name: Set up Python 3.9
	uses: actions/setup-python@v4
	with:
	python-version: '3.9'
	- name: Install pip dependencies
	run: \|
	pip install --upgrade pip setuptools
	pip install coveralls
	pip install -e '.[tests]'
	- name: Start docker container
	run: \|
	docker run -d -p 0.0.0.0:8945:5000 --name hepdata-converter-ws-tests hepdata/hepdata-converter-ws
	sleep 1
	- name: Run tests
	run: \|
	coverage run -m unittest discover hepdata_converter_ws_client/testsuite 'test_*'
	- name: Run coveralls
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	COVERALLS_SERVICE_NAME: github
	run: \|
	coveralls

	deploy:
	needs: test
	if: github.event_name == 'release'
	runs-on: ubuntu-latest
	environment:
	name: pypi
	url: https://pypi.org/p/hepdata-converter-ws-client
	permissions:
	id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
	steps:
	- uses: actions/checkout@v4
	- name: Set up Python 3.9
	uses: actions/setup-python@v4
	with:
	python-version: '3.9'
	- name: Build PyPI package
	run: \|
	pip install wheel
	python setup.py sdist bdist_wheel
	- name: Publish distribution to PyPI
	uses: pypa/gh-action-pypi-publish@release/v1

Provide feedback