Refine trusted publishing workflows

.github/workflows/pypi-publish.yml

@@ -1,9 +1,9 @@
 name: "Publish Python distribution to PyPI"
 # Uses:
-# https://github.com/actions/setup-python : 0b93645e9fea7318ecaed2b359559ac225c90a2b
+# https://github.com/actions/setup-python : a26af69be951a213d495a4c3e4e4022e16d87065
 # https://github.com/actions/checkout : 11bd71901bbe5b1630ceea73d27597364c9af683
-# https://github.com/actions/download-artifact : fa0a91b85d4f404e444e00e005971372dc801d16
-# https://github.com/actions/upload-artifact : 6f51ac03b9356f520e9adb1b1b7802705f340c2b
+# https://github.com/actions/download-artifact : d3f86a106a0bac45b974a628896c90dbdf5c8093
+# https://github.com/actions/upload-artifact : ea165f8d65b6e75b540449e92b4886f43607fa02
 # https://github.com/actions/pypa/gh-action-pypi-publish : 76f52bc884231f62b9a034ebfe128415bbaabdfc
 
 on:
@@ -12,45 +12,50 @@ on:
 
 jobs:
   build:
-    name: "Build distribution"
+    name: "Build package"
     runs-on: "ubuntu-latest"
+    outputs:
+      artifact-id: "${{ steps.upload-artifact.outputs.artifact-id }}"
 
     steps:
       - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           persist-credentials: false
 
       - name: "Set up Python"
-        uses: "actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b"
+        uses: "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065"
         with:
           python-version: "3.12"
 
       - name: "Build the package"
-        run: "python -m pip install nox; nox --session build"
+        run: "python -m pip install nox; nox -s build"
 
       - name: "Store the distribution packages"
-        uses: "actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b"
+        id: "upload-artifact"
+        uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
         with:
-          name: "python-package-distributions"
-          path: "dist/"
+          path: "./dist"
 
   publish-to-pypi:
     name: "Publish Python Distribution to PyPI"
-    if: startsWith(github.ref, 'refs/tags/')
     needs: ["build"]
     runs-on: "ubuntu-latest"
     environment:
       name: "pypi"
-      url: "https://pypi.org/p/commented-configparser"
+      url: "https://pypi.org/project/commented-configparser/"
     permissions:
       id-token: "write"
 
     steps:
       - name: "Download all the dists"
-        uses: "actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16"
+        uses: "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093"
         with:
-          name: "python-package-distributions"
-          path: "dist/"
+          artifact-ids: "${{ needs.build.outputs.artifact-id }}"
+          path: "./dist"
+          merge-multiple: true
 
       - name: "Publish distribution to PyPI"
         uses: "pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc"
+        with:
+          repository-url: "https://upload.pypi.org/legacy/"
+          verbose: true

.github/workflows/pypi-test-publish.yml

@@ -0,0 +1,62 @@
+name: "Publish Python distribution to PyPI Test"
+# Uses:
+# https://github.com/actions/setup-python : a26af69be951a213d495a4c3e4e4022e16d87065
+# https://github.com/actions/checkout : 11bd71901bbe5b1630ceea73d27597364c9af683
+# https://github.com/actions/download-artifact : d3f86a106a0bac45b974a628896c90dbdf5c8093
+# https://github.com/actions/upload-artifact : ea165f8d65b6e75b540449e92b4886f43607fa02
+# https://github.com/actions/pypa/gh-action-pypi-publish : 76f52bc884231f62b9a034ebfe128415bbaabdfc
+
+on:
+  push:
+    tags:
+      - "[0-9]+.[0-9]+.[a-z]+[0-9]+"
+
+jobs:
+  build:
+    name: "Build package"
+    runs-on: "ubuntu-latest"
+    outputs:
+      artifact-id: "${{ steps.upload-artifact.outputs.artifact-id }}"
+
+    steps:
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
+        with:
+          persist-credentials: false
+
+      - name: "Set up Python"
+        uses: "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065"
+        with:
+          python-version: "3.12"
+
+      - name: "Build the package"
+        run: "python -m pip install nox; nox -s build"
+
+      - name: "Store the distribution packages"
+        id: "upload-artifact"
+        uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
+        with:
+          path: "./dist"
+
+  publish-to-pypi:
+    name: "Publish Python Distribution to PyPI"
+    needs: ["build"]
+    runs-on: "ubuntu-latest"
+    environment:
+      name: "testpypi"
+      url: "https://test.pypi.org/project/commented-configparser/"
+    permissions:
+      id-token: "write"
+
+    steps:
+      - name: "Download all the dists"
+        uses: "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093"
+        with:
+          artifact-ids: "${{ needs.build.outputs.artifact-id }}"
+          path: "./dist"
+          merge-multiple: true
+
+      - name: "Publish distribution to PyPI"
+        uses: "pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc"
+        with:
+          repository-url: "https://test.pypi.org/legacy/"
+          verbose: true

.github/workflows/python-tests.yml

@@ -1,9 +1,9 @@
 name: "python tests and coverage"
 # Uses:
-# https://github.com/actions/setup-python : 0b93645e9fea7318ecaed2b359559ac225c90a2b
+# https://github.com/actions/setup-python : a26af69be951a213d495a4c3e4e4022e16d87065
 # https://github.com/actions/checkout : 11bd71901bbe5b1630ceea73d27597364c9af683
-# https://github.com/actions/download-artifact : fa0a91b85d4f404e444e00e005971372dc801d16
-# https://github.com/actions/upload-artifact : 6f51ac03b9356f520e9adb1b1b7802705f340c2b
+# https://github.com/actions/download-artifact : d3f86a106a0bac45b974a628896c90dbdf5c8093
+# https://github.com/actions/upload-artifact : ea165f8d65b6e75b540449e92b4886f43607fa02
 
 on:
   pull_request:
@@ -46,7 +46,7 @@ jobs:
         uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
 
       - name: "Set up Python ${{ matrix.python-version }}"
-        uses: "actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b"
+        uses: "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065"
         with:
           python-version: "${{ matrix.python-version }}"
           allow-prereleases: true
@@ -60,7 +60,7 @@ jobs:
           nox --session test -- partial-coverage
 
       - name: "Save coverage artifact"
-        uses: "actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b"
+        uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
         with:
           name: "coverage-artifact-${{ matrix.os}}-${{ matrix.python-version}}"
           path: ".coverage.*"
@@ -76,7 +76,7 @@ jobs:
         uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
 
       - name: "Set up Python"
-        uses: "actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b"
+        uses: "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065"
         with:
           python-version: "${{ needs.settings.outputs.default-python-version }}"
 
@@ -85,7 +85,7 @@ jobs:
           python -m pip install --upgrade nox
 
       - name: "Download coverage artifacts"
-        uses: "actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16"
+        uses: "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093"
         with:
           pattern: "coverage-artifact-*"
           merge-multiple: true
@@ -106,7 +106,7 @@ jobs:
         uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
 
       - name: "Set up Python"
-        uses: "actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b"
+        uses: "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065"
         with:
           python-version: "${{ needs.settings.outputs.default-python-version }}"