ci: do releases via the GH interface (#100)

* ci: do releases via the GH interface

* ci: use trusted publishing

* ci: only update draft release on push to main

.github/workflows/auto-merge-deps.yml

@@ -0,0 +1,14 @@
+name: auto-merge
+
+on:
+  pull_request:
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ahmadnassri/action-dependabot-auto-merge@v2
+        with:
+          target: minor
+          github-token: ${{ secrets.AUTO_MERGE }}

.github/workflows/check-build.yml

@@ -0,0 +1,27 @@
+name: Check Distribution Build
+
+on: push
+
+jobs:
+  check-build:
+    name: Twine Check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
+      - name: Install Build Tools
+        run: pip install build twine
+
+      - name: Build a binary wheel
+        run: |
+          python -m build .
+
+      - name: Check Distribution
+        run: |
+          twine check dist/*

.github/workflows/deploy.yaml

@@ -1,17 +1,18 @@
 name: Publish Python distributions to PyPI
 
 on:
-  push:
-    tags:
-      - '*'
+  release:
+    types: [published]
 
 jobs:
   build-n-publish:
     name: Build and publish to PyPI
     runs-on: ubuntu-latest
     env:
       ENV_NAME: publish
-      PYTHON: 3.8
+      PYTHON: "3.10"
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
     steps:
       - uses: actions/checkout@main
         with:
@@ -30,8 +31,4 @@ jobs:
           python -m build
 
       - name: Publish to PyPI
-        if: startsWith(github.event.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@master
-        with:
-          user: __token__
-          password: ${{ secrets.pypi_password }}
+        uses: pypa/[email protected]

.github/workflows/release-draft.yml

@@ -0,0 +1,23 @@
+name: Update Draft Release
+
+on:
+  push:
+    branches: main
+
+jobs:
+  draft-release:
+    name: Update Draft Release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
+      - name: Publish the release notes
+        uses: release-drafter/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}