Move to PyPI Trusted Publisher Management

[ItsDrike]

No description provided.

[PerchunPak]

I doubt that it supports poetry, but as we have the only one way to test this - production - we have no choice.

[ItsDrike]

I doubt that it supports poetry, but as we have the only one way to test this - production - we have no choice.

You mean the pypa/gh-action-pypi-publish action? It has nothing to do with poetry. We use poetry to build the project, i.e. create the dist/ folder containing all of the needed distribution files (wheels) that should get uploaded to PyPI.

The action originally did that uploading with poetry publish, which is just poetry's nice utility that calls the PyPI API in the back, authenticates using the provided token and uploads the built distribution files. Projects that don't use poetry would often do twine upload dist/* instead as an example here. (You can do this even if you do use poetry, but there's no reason to install twine, since poetry has it built-in.)

This action is then just another way to do this, but it also supports the new Trusted Publisher Management, which poetry publish doesn't, that is why I switched to using it.

[PerchunPak]

Also saw that you have tested it already on some other projects in Discord. Btw, here is discussion about this PR in Discord for those, who are looking for the history.