ci: use PyPI attestations instead of sigstore + gh release upload #78

	# SPDX-License-Identifier: Apache-2.0
	---

	name: Build, test, and upload PyPI package

	on:
	push:
	branches:
	- main
	tags:
	- "v*"
	pull_request:
	branches:
	- main
	release:
	types:
	- published

	permissions: {}

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	build-package:
	name: Build and check packages
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- uses: hynek/build-and-inspect-python-package@fe0a0fb1925ca263d076ca4f2c13e93a6e92a33e # v2.17.0

	publish-pypi:
	name: Publish to PyPI
	if: github.repository_owner == 'python-wheel-build' && github.event.action == 'published'
	needs: build-package
	runs-on: ubuntu-latest
	environment: pypi
	permissions:
	id-token: write
	attestations: write
	contents: read
	steps:
	- name: Fetch build artifacts
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
	with:
	name: Packages
	path: dist

	- name: Verify sdist and wheel are present
	run: \|
	ls dist/*.tar.gz
	ls dist/*.whl

	- name: Upload to PyPI
	uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
	with:
	attestations: true

Provide feedback