Improve pypi.yaml

[ns-rse]

As with TopoStats (see #1173) we can improve the structure and workflow of our pypi.yaml to reduce security risks.

One of the developers of the pypa/gh-action-pypi-publish has highlighted a couple of
issues with
.github/workflows/pypi.yaml that we should address.

Should be a simple case of copying the current workflow from TopoStats over (see
#1176), but worth noting that publishing to TestPyPI was disabled
because interim builds will never comply with the version
specifiers that are in place (see #1179).

Ergo just copy .github/workflows/pypi.yaml from the current main branch....

name: Publish package to PyPi
# See https://docs.pypi.org/trusted-publishers/adding-a-publisher/

on:
  pull_request:
    branches:
      - main
  workflow_dispatch: # Uncomment line if you also want to trigger action manually

jobs:
  build:
    name: Build Package
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.11
      - name: Installing the package
        run: |
          pip3 install .[pypi]
      - name: Build package
        run: |
          pip3 install --upgrade setuptools
          export DEB_PYTHON_INSTALL_LAYOUT=deb_system
          python -m build --no-isolation
      - name: Store the distribution packages
        uses: actions/upload-artifact@v4
        with:
          name: python-package-distributions
          path: dist/

  publish-to-pypi:
    name: Publish Python 🐍 distribution 📦 to PyPI
    if: startsWith(github.ref, 'refs/tags/') # only publish to PyPI on tag pushes
    needs:
      - build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    environment:
      name: pypi-publish
      url: https://pypi.org/p/topostats
    steps:
      - name: Download all the dists
        uses: actions/download-artifact@v4
        with:
          name: python-package-distributions
          path: dist/

      - name: Publish distribution 📦 to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1
        with:
          user: __token__
          password: ${{ secrets.PYPI_API_TOKEN }}

  # publish-to-testpypi:
  #   name: Publish Python 🐍 distribution 📦 to TestPyPI
  #   needs:
  #     - build
  #   runs-on: ubuntu-latest

  #   environment:
  #     name: testpypi
  #     url: https://test.pypi.org/p/topostats

  #   permissions:
  #     id-token: write # IMPORTANT: mandatory for trusted publishing

  #   steps:
  #     - name: Download all the dists
  #       uses: actions/download-artifact@v4
  #       with:
  #         name: python-package-distributions
  #         path: dist/
  #     - name: Publish distribution 📦 to TestPyPI
  #       uses: pypa/gh-action-pypi-publish@release/v1
  #       with:
  #         repository-url: https://test.pypi.org/legacy/