From 737cd7cf272ec47d2d001116bbaa22ae45159c56 Mon Sep 17 00:00:00 2001
From: "Jack S. Hale" <mail@jackhale.co.uk>
Date: Thu, 10 Oct 2024 12:40:00 +0200
Subject: [PATCH] pypi trusted publishing (#314)

* Update version number.

* Fix

* Correct tag ref

* Use BaseArgument.__eq__ in Argument (#147)

(cherry picked from commit e68314821b6f3c157bd396a8c457cd9e4628296e)

* Oops! Bump version number.

* Fix.

* Bump version.

* Updated to .md README (#275)

* Kebab case in build-wheels.yml (#276)

* Fixes for pypa packaging.

* Correct documentation links (#277)

* Remove unecessary pip pinning (#278)

* Bump version.

* Update version to 2024.2.0

* Try trusted publishing on pypi.

* Remove version change.

* Fix.

* Tidy.

* Simplify.

---------

Co-authored-by: Chris Richardson <chris@bpi.cam.ac.uk>
Co-authored-by: Michal Habera <michal.habera@gmail.com>
Co-authored-by: Garth N. Wells <gnw20@cam.ac.uk>
---
 .github/workflows/build-wheels.yml | 50 ++++++++++++++++++++----------
 1 file changed, 33 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/build-wheels.yml b/.github/workflows/build-wheels.yml
index e7118028c..7301b1b6c 100644
--- a/.github/workflows/build-wheels.yml
+++ b/.github/workflows/build-wheels.yml
@@ -11,11 +11,11 @@ on:
         default: "main"
         type: string
       test_pypi_publish:
-        description: "Publish to Test PyPi (true | false)"
+        description: "Publish to Test PyPi"
         default: false
         type: boolean
       pypi_publish:
-        description: "Publish to PyPi (true | false)"
+        description: "Publish to PyPi"
         default: false
         type: boolean
 
@@ -26,11 +26,11 @@ on:
         default: "main"
         type: string
       test_pypi_publish:
-        description: "Publish to Test PyPi (true | false)"
+        description: "Publish to Test PyPi"
         default: false
         type: boolean
       pypi_publish:
-        description: "Publish to PyPi (true | false))"
+        description: "Publish to PyPi"
         default: false
         type: boolean
 
@@ -54,28 +54,44 @@ jobs:
         with:
           path: dist/*
 
-  upload_pypi:
-    name: Upload to PyPI (optional)
+  upload_test_pypi:
+    name: Upload to test PyPI (optional)
+    if: ${{ github.event.inputs.test_pypi_publish == 'true' }}
     needs: [build]
     runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/fenics-ufl
+    permissions:
+      id-token: write
+    
     steps:
       - uses: actions/download-artifact@v4
         with:
           name: artifact
           path: dist
 
-      - name: Push to PyPI
+      - name: Push to test PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        if: ${{ github.event.inputs.pypi_publish == 'true' }}
         with:
-          user: __token__
-          password: ${{ secrets.PYPI_TOKEN }}
-          repository-url: https://upload.pypi.org/legacy/
+          repository-url: https://test.pypi.org/legacy/
+  
+  upload_pypi:
+    name: Upload to PyPI (optional)
+    if: ${{ github.event.inputs.pypi_publish == 'true' }}
+    needs: [build]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/fenics-ufl
+    permissions:
+      id-token: write
+    
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: artifact
+          path: dist
 
-      - name: Push to Test PyPI
+      - name: Push to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        if: ${{ github.event.inputs.test_pypi_publish == 'true' }}
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_TEST_TOKEN }}
-          repository-url: https://test.pypi.org/legacy/