Try doing PyPI uploads from CI

We won't know whether this works until we try it live.

.github/workflows/deployment.yml

@@ -1,5 +1,10 @@
 name: Continuous Delivery
 
+env:
+  # NOTE: This version must match between all .yml files in the
+  # .github/workflows directory
+  TOX_VERSION: 4.0.9
+
 on:
   push:
     tags:
@@ -14,3 +19,43 @@ jobs:
         with:
           token: ${{secrets.JOHAN_GITHUB_API_TOKEN}}
           formula: px
+
+  pypi:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pxpx
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
+    steps:
+      #
+      # First, we need to create a wheel. We do this by running tox, just like
+      # in linux-ci.yml.
+      #
+      - name: Check out repository code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # For getting tags from the repo
+      - name: Cache .tox directory
+        uses: actions/cache@v3
+        with:
+          path: .tox
+          key: ${{ runner.os }}-${{ hashFiles('tox.ini') }}
+      - name: Create a virtualenv
+        run: |
+          python3 -m venv env
+      - name: Install tox in our virtualenv
+        run: |
+          . ./env/bin/activate
+          pip install tox==${{ env.TOX_VERSION }}
+      - name: Run tox in our virtualenv
+        run: |
+          . ./env/bin/activate
+          tox
+
+      #
+      # Wheel created, publish it!
+      #
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.github/workflows/linux-ci.yml

@@ -1,5 +1,10 @@
 name: Linux CI
 
+env:
+  # NOTE: This version must match between all .yml files in the
+  # .github/workflows directory
+  TOX_VERSION: 4.0.9
+
 on:
   # Triggers the workflow on push or pull request events but only for the main branch
   push:
@@ -40,7 +45,7 @@ jobs:
       - name: Install tox in our virtualenv
         run: |
           . ./env/bin/activate
-          pip install tox==4.0.9
+          pip install tox==${{ env.TOX_VERSION }}
       - name: Run tox in our virtualenv
         run: |
           . ./env/bin/activate

.github/workflows/macos-ci.yml

@@ -1,5 +1,10 @@
 name: macOS CI
 
+env:
+  # NOTE: This version must match between all .yml files in the
+  # .github/workflows directory
+  TOX_VERSION: 4.0.9
+
 on:
   # Triggers the workflow on push or pull request events but only for the main branch
   push:
@@ -26,7 +31,7 @@ jobs:
       - name: Install tox in our virtualenv
         run: |
           . ./env/bin/activate
-          pip install tox==4.0.9
+          pip install tox==${{ env.TOX_VERSION }}
       - name: Run tox in our virtualenv
         run: |
           . ./env/bin/activate

devbin/release.sh

@@ -92,32 +92,13 @@ set -x
 
 find . -name 'px*.whl' -delete
 
-# Build the release
+# Test and build the release so we know it works before we release it
 tox
 
-# Make a relelase virtualenv
-ENVDIR="$(mktemp -d)"
-function cleanup {
-  rm -rf "${ENVDIR}"
-}
-trap cleanup EXIT
-
-virtualenv "${ENVDIR}"
-# shellcheck source=/dev/null
-. "${ENVDIR}"/bin/activate
-
-# Work around having an old version of OpenSSL
+# Mark new release on Github.
 #
-# https://github.com/pypa/twine/issues/273#issuecomment-334911815
-pip install "ndg-httpsclient == 0.4.3"
-
-pip install "twine == 4.0.2"
-
-# Upload!
-echo
-twine upload --repository pypi dist/pxpx-*-py3-none-any.whl
-
-# Mark new release on Github
+# Note that this implicitly triggers uploads to Homebrew and PyPI through GitHub
+# actions configured in .github/workflows.
 git push --tags
 
 cat <<EOM