Configure "trusted publishing" in Github workflow

The TestPyPI isn't configured because it's kind of unusable in the CI
(since we can only upload package files once per version, and the
"skip-existing" parameter isn't recommended).

.github/workflows/packaging.yml

@@ -3,7 +3,7 @@ name: Packaging
 on: [push, pull_request]
 
 jobs:
-  packaging:
+  build:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.repository
     runs-on: ubuntu-22.04
     steps:
@@ -19,4 +19,26 @@ jobs:
         python -m pip install tox
     - name: Build package
       run: |
-        tox -e packaging
+        tox -e build
+    - name: Upload package
+      uses: actions/upload-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+  publish:
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-22.04
+    needs: build
+    environment:
+      name: pypi
+      url: https://pypi.org/project/loguru/
+    permissions:
+      id-token: write
+    steps:
+    - name: Download package
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish package
+      uses: pypa/gh-action-pypi-publish@release/v1

tox.ini

@@ -1,5 +1,5 @@
 [tox]
-envlist = lint, tests, docs, packaging
+envlist = lint, tests, docs, build
 isolated_build = True
 
 [testenv]
@@ -24,17 +24,8 @@ description = Build the HTML documentation.
 commands =
     sphinx-build -a -b html -W --keep-going docs/ docs/build
 
-[testenv:packaging]
+[testenv:build]
 description = Build the Python package.
 commands =
     pyproject-build .
     twine check --strict dist/*
-
-[testenv:release]
-description = Publish a new release on PyPI.
-passenv =
-    TWINE_USERNAME
-    TWINE_PASSWORD
-commands =
-    {[testenv:packaging]commands}
-    twine upload dist/* --disable-progress-bar --verbose