feat: pypi test jobs, better permissions management

.github/workflows/publish.yml

@@ -6,8 +6,11 @@
     workflow_call:
 
   env: 
-    PYTHON_VERSION: 3.12.4   
-
+    PYTHON_VERSION: 3.12.4
+
+  permissions:
+    contents: read
+
   jobs:
     build_sdist:
       name: Build SDist
@@ -21,30 +24,52 @@
           with:
             python-version: ${{ env.PYTHON_VERSION }}
             cache: "poetry"
-  
+
         - name: Build SDist
-          working-directory: pragma-sdk
+          working-directory: ./pragma-sdk/
           run: poetry build -f sdist
 
         - uses: actions/upload-artifact@v4
           with:
             name: sdist
-            path: pragma-sdk/dist
+            path: pragma-sdk/dist/
+            if-no-files-found: error
 
-    upload_pypi:
-      name: Upload package to PyPI
+    pypi_test_publish:
+      name: Upload package to Test PyPI
       needs: [build_sdist]
       runs-on: ubuntu-latest
-
+      environment: testpypi
+      permissions:
+        id-token: write
       steps:
         - uses: actions/download-artifact@v4
           with:
             name: sdist
-            path: pragma-sdk/dist
-
+            path: pragma-sdk/dist/
+
+        - uses: pypa/gh-action-pypi-publish@release/v1
+          with:
+            repository-url: https://test.pypi.org/legacy/
+            packages-dir: pragma-sdk/dist/
+            skip-existing: true
+
+    pypi_publish:
+      name: Upload package to PyPI
+      needs: [build_sdist, pypi_test_publish]
+      runs-on: ubuntu-latest
+      environment:
+        name: pypi
+        url: https://pypi.org/p/pragma-sdk
+      permissions:
+        id-token: write
+      steps:
+        - uses: actions/download-artifact@v4
+          with:
+            name: sdist
+            path: pragma-sdk/dist/
+
         - uses: pypa/gh-action-pypi-publish@release/v1
           with:
+            packages-dir: pragma-sdk/dist/
             skip-existing: true
-            packages-dir: pragma-sdk/dist
-            user: __token__
-            password: ${{ secrets.PYPI_API_TOKEN }}