From 35fcaed9493ab94b823e50a0285324ef26a232ea Mon Sep 17 00:00:00 2001
From: Alex Carney <alcarneyme@gmail.com>
Date: Fri, 6 Oct 2023 19:42:28 +0100
Subject: [PATCH] workflow: Switch to using trusted publishers

---
 .github/workflows/lsp-devtools-release.yml |  66 +++++++++
 .github/workflows/pytest-lsp-release.yml   |  67 +++++++++
 .github/workflows/release.yml              | 157 ---------------------
 3 files changed, 133 insertions(+), 157 deletions(-)
 create mode 100644 .github/workflows/lsp-devtools-release.yml
 create mode 100644 .github/workflows/pytest-lsp-release.yml
 delete mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/lsp-devtools-release.yml b/.github/workflows/lsp-devtools-release.yml
new file mode 100644
index 0000000..cb486da
--- /dev/null
+++ b/.github/workflows/lsp-devtools-release.yml
@@ -0,0 +1,66 @@
+name: Release: lsp-devtools
+
+on:
+  push:
+    branches:
+    - release
+    paths:
+    - 'lib/lsp-devtools/**'
+
+jobs:
+  release:
+    name: lsp-devtools release
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/lsp-devtools
+    permissions:
+      id-token: write
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - uses: actions/setup-python@v4
+      with:
+        python-version: "3.10"
+
+    - run: |
+        sudo apt update
+        sudo apt install pandoc
+
+        python --version
+        python -m pip install --upgrade pip
+        python -m pip install build bump2version towncrier docutils
+      name: Install Build Tools
+
+    - run: |
+        set -e
+
+        ./scripts/make-release.sh lsp-devtools
+      name: Set Version
+      id: info
+
+    - name: Package
+      run: |
+        cd lib/lsp-devtools
+        python -m build
+
+    - name: 'Upload Artifact'
+      uses: actions/upload-artifact@v3
+      with:
+        name: 'dist'
+        path: lib/lsp-devtools/dist
+
+    - name: Publish
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        packages-dir: lib/lsp-devtools/dist/
+
+    - name: Create Release
+      run: |
+        gh release create "${RELEASE_TAG}" \
+          --title "lsp-devtools v${VERSION} - ${RELEASE_DATE}" \
+          -F lib/lsp-devtools/.changes.html \
+          ./lib/lsp-devtools/dist/*
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pytest-lsp-release.yml b/.github/workflows/pytest-lsp-release.yml
new file mode 100644
index 0000000..4380593
--- /dev/null
+++ b/.github/workflows/pytest-lsp-release.yml
@@ -0,0 +1,67 @@
+name: Release: pytest-lsp
+
+on:
+  push:
+    branches:
+    - release
+    paths:
+    - 'lib/pytest-lsp/**'
+
+jobs:
+  release:
+    name: pytest-lsp release
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pytest-lsp
+    permissions:
+      id-token: write
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - uses: actions/setup-python@v4
+      with:
+        python-version: "3.10"
+
+    - run: |
+        sudo apt update
+        sudo apt install pandoc
+
+        python --version
+        python -m pip install --upgrade pip
+        python -m pip install build bump2version towncrier docutils
+
+      name: Install Build Tools
+
+    - run: |
+        set -e
+
+        ./scripts/make-release.sh pytest-lsp
+      name: Set Version
+      id: info
+
+    - name: Package
+      run: |
+        cd lib/pytest-lsp
+        python -m build
+
+    - name: 'Upload Artifact'
+      uses: actions/upload-artifact@v3
+      with:
+        name: 'dist'
+        path: lib/pytest-lsp/dist
+
+    - name: Publish
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        packages-dir: lib/pytest-lsp/dist/
+
+    - name: Create Release
+      run: |
+        gh release create "${RELEASE_TAG}" \
+          --title "pytest-lsp v${VERSION} - ${RELEASE_DATE}" \
+          -F lib/pytest-lsp/.changes.html \
+          ./lib/pytest-lsp/dist/*
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index d3a8814..0000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,157 +0,0 @@
-name: Release
-
-on:
-  push:
-    branches:
-    - release
-
-jobs:
-  # Simple job the checks to see which parts we actually have to build.
-  trigger:
-    name: Trigger
-    runs-on: ubuntu-latest
-    outputs:
-      lsp-devtools: ${{steps.check-lsp-devtools.outputs.build}}
-      pytest-lsp: ${{steps.check-pytest-lsp.outputs.build}}
-    steps:
-    - uses: actions/checkout@v3
-      with:
-        fetch-depth: 0
-
-    - run: |
-        if [ -z "${BASE_REF}" ]; then
-          echo "BASE=HEAD^" >> $GITHUB_ENV
-        else
-          echo "BASE=origin/${BASE_REF}" >> $GITHUB_ENV
-        fi
-      name: Determine base
-      env:
-        BASE_REF: ${{ github.base_ref }}
-
-    - id: check-lsp-devtools
-      run: |
-        set -e
-        echo ${BASE}
-
-        ./scripts/should-build.sh lsp-devtools
-      name: "Build lsp-devtools?"
-
-    - id: check-pytest-lsp
-      run: |
-        set -e
-        echo ${BASE}
-
-        ./scripts/should-build.sh pytest-lsp
-      name: "Build pytest-lsp?"
-
-  lsp-devtools:
-    name: lsp-devtools
-    needs: trigger
-    if: always() && needs.trigger.outputs.lsp-devtools
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v3
-
-    - uses: actions/setup-python@v4
-      with:
-        python-version: "3.10"
-
-    - run: |
-        sudo apt update
-        sudo apt install pandoc
-
-        python --version
-        python -m pip install --upgrade pip
-        python -m pip install build bump2version towncrier docutils
-      name: Install Build Tools
-
-    - run: |
-        set -e
-
-        ./scripts/make-release.sh lsp-devtools
-      name: Set Version
-      id: info
-
-    - name: Package
-      run: |
-        cd lib/lsp-devtools
-        python -m build
-
-    - name: 'Upload Artifact'
-      uses: actions/upload-artifact@v3
-      with:
-        name: 'dist'
-        path: lib/lsp-devtools/dist
-
-    - name: Publish
-      id: assets
-      run: |
-        cd lib/lsp-devtools
-        python -m pip install twine
-        python -m twine upload dist/* -u alcarney -p ${{ secrets.PYPI_PASS }}
-
-    - name: Create Release
-      run: |
-        gh release create "${RELEASE_TAG}" \
-          --title "lsp-devtools v${VERSION} - ${RELEASE_DATE}" \
-          -F lib/lsp-devtools/.changes.html \
-          ./lib/lsp-devtools/dist/*
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  pytest-lsp:
-    name: pytest-lsp
-    needs: trigger
-    if: always() && needs.trigger.outputs.pytest-lsp
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v3
-
-    - uses: actions/setup-python@v4
-      with:
-        python-version: "3.10"
-
-    - run: |
-        sudo apt update
-        sudo apt install pandoc
-
-        python --version
-        python -m pip install --upgrade pip
-        python -m pip install build bump2version towncrier docutils
-
-      name: Install Build Tools
-
-    - run: |
-        set -e
-
-        ./scripts/make-release.sh pytest-lsp
-      name: Set Version
-      id: info
-
-    - name: Package
-      run: |
-        cd lib/pytest-lsp
-        python -m build
-
-    - name: 'Upload Artifact'
-      uses: actions/upload-artifact@v3
-      with:
-        name: 'dist'
-        path: lib/pytest-lsp/dist
-
-    - name: Publish
-      run: |
-        cd lib/pytest-lsp
-        python -m pip install twine
-        python -m twine upload dist/* -u alcarney -p ${{ secrets.PYPI_PASS }}
-
-    - name: Create Release
-      run: |
-        gh release create "${RELEASE_TAG}" \
-          --title "pytest-lsp v${VERSION} - ${RELEASE_DATE}" \
-          -F lib/pytest-lsp/.changes.html \
-          ./lib/pytest-lsp/dist/*
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}