Publish the python library to TestPyPI and PyPI

- Github "Trusted Publisher" must be configured on TestPyPI & PyPI
- Like previously the publishing triggering to TestPyPI, PyPI or github release is manual
- an error will occur if the same version already exists on TestPyPI or PyPI

Author: Thierry RAMORASOAVINA

.github/workflows/pip.yml

@@ -1,4 +1,7 @@
 ---
+# After building and testing the pip package,
+# this workflow publishes it to Github Release by default
+# and to Test PyPI (TEST) or PyPI (PROD) if requested
 name: Pip Package
 env:
   DEFAULT_SAMPLES_REVISION: 11.0.0
@@ -11,6 +14,11 @@ on:
       image-tag:
         default: 11.0.0-b.0.0
         description: Development Docker Image Tag
+      pypi-target:
+        type: choice
+        default: testpypi
+        options: [testpypi, pypi]
+        description: Publish to Test PyPI (TEST) or PyPI (PROD)
   pull_request:
     paths:
       - setup.py
@@ -35,6 +43,7 @@ jobs:
       packages: read
     steps:
       - name: Checkout sources
+        # no explict branch specified so this step should check out the github.ref branch or tag
         uses: actions/checkout@v4
         with:
           # Get Git tags so that versioneer can function correctly
@@ -51,13 +60,14 @@ jobs:
           # Install required Python build dependency
           pip install build
 
-          # Build the package
+          # Build the source package (sdist) only            
+          # a binary one (wheel) - platform dependent - would be a hassle
           python3 -m build --sdist
-      - name: Upload package as artifact
+      - name: Upload the package as artifact
         uses: actions/upload-artifact@v4
         with:
           name: pip-package
-          path: ./dist/khiops*.tar.gz
+          path: ./dist/
   test:
     needs: build
     runs-on: ubuntu-22.04
@@ -83,14 +93,14 @@ jobs:
           ref: ${{ env.SAMPLES_REVISION }}
           token: ${{ secrets.GITHUB_TOKEN }}
           path: khiops-samples
-      - name: Download package artifact
+      - name: Download package artifacts
         uses: actions/download-artifact@v4
         with:
           name: pip-package
       - name: Install package
         run: |
           pip install --upgrade pip
-          pip install $(ls khiops*.tar.gz)
+          pip install $(ls khiops*.tar.gz)  # install the source package
       - name: Run tests
         env:
           KHIOPS_SAMPLES_DIR: ${{ github.workspace }}/khiops-samples
@@ -119,7 +129,11 @@ jobs:
           # The MPI command is not always named mpiexec, but can be orterun etc
           # (as given by khiops_env)
           kh-status | grep "MPI command" | grep -vwq "<empty>"
-  release:
+  # The implementation of a unique release job with multiple conditional steps
+  # for each publishing mode is not chosen
+  # because of the required job environment verified for Trusted Publishing
+  release-github:
+    # only publish on tag pushes
     if: github.ref_type == 'tag'
     needs: [build, test]
     runs-on: ubuntu-22.04
@@ -130,13 +144,59 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           name: pip-package
-      - name: Upload Pip package to the release
+          path: dist/
+      - name: Upload Pip source package to the github release
         uses: ncipollo/release-action@v1.15.0
         with:
           allowUpdates: true
-          artifacts: khiops*.tar.gz
+          artifacts: dist/khiops*.tar.gz
           body: '**For testing purposes only**'
           draft: false
           makeLatest: false
           prerelease: true
           updateOnlyUnreleased: true
+  release-testpypi:
+    # only publish on testpypi if requested and on tag pushes
+    if: inputs.pypi-target == 'testpypi' && github.ref_type == 'tag'
+    needs: [build, test]
+    runs-on: ubuntu-22.04
+    permissions:
+      # IMPORTANT: OIDC token mandatory for trusted publishing on TestPyPI and PyPI
+      id-token: write
+    # required job environment verified for Trusted Publishing
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/khiops
+    steps:
+      - name: Download package artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: pip-package
+          path: dist/
+      - name: Publish Python distribution to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          verbose: true
+          repository-url: https://test.pypi.org/legacy/
+  release-pypi:
+    # only publish on pypi if requested and on tag pushes
+    if: inputs.pypi-target == 'pypi' && github.ref_type == 'tag'
+    needs: [build, test]
+    runs-on: ubuntu-22.04
+    permissions:
+      # IMPORTANT: OIDC token mandatory for trusted publishing on TestPyPI and PyPI
+      id-token: write
+    # required job environment verified for Trusted Publishing
+    environment:
+      name: pypi
+      url: https://pypi.org/p/khiops
+    steps:
+      - name: Download package artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: pip-package
+          path: dist/
+      - name: Publish Python distribution to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          verbose: true