Rework GitHub Actions to correctly and sanely push to PyPi in a controlled manner (#456)

* begin OIDC pypi publishing

* cleanup actions

* build extras

* remove cibw

* build extras

* unique artifact names

* force an update first

Author: AbstractUmbra

.github/dependabot.yaml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/build.yml

@@ -6,7 +6,8 @@ on:
     types: [opened, edited, synchronize]
 
 jobs:
-  lib:
+  build:
+    name: Build wheels
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -15,34 +16,51 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Install CPython
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
-          python-version: ${{matrix.python-version}}
+          python-version: ${{ matrix.python-version }}
 
-      - name: Install Deps
+      - name: Install deps
         run: |
-          python -m ensurepip
-          pip install wheel setuptools
-          pip install -r requirements.txt
+          pip install -U wheel setuptools pip Cython
+          pip install '.[speed,sound]'
 
-      - name: Build
-        run: python setup.py sdist bdist_wheel
+      - name: Build wheels
+        run: pip wheel -w ./wheelhouse/ '.[speed,sound]'
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-wheels-${{ matrix.python-version }}
+          path: ./wheelhouse/twitchio*.whl
+
+  sdist:
+    name: Make source distribution
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - run: pipx run build --sdist
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-source-dist
+          path: "./**/dist/*.tar.gz"
 
   docs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Install CPython
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v5
         with:
           python-version: 3.7
 
@@ -62,19 +80,41 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-    - name: checkout
-      uses: actions/checkout@v2
-
-    - name: Setup Python
-      uses: actions/setup-python@v2
-      with:
-        python-version: 3.7
-
-    - name: install black
-      run: |
-        python -m ensurepip
-        pip install black
-
-    - name: run linter
-      run: |
-        black twitchio --line-length 120 --verbose --check
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.7
+
+      - name: install black
+        run: |
+          python -m ensurepip
+          pip install black
+
+      - name: run linter
+        run: |
+          black twitchio --line-length 120 --verbose --check
+
+  upload_pypi:
+    if: github.event_name == 'push' && github.ref_type == 'tag'
+    name: Publish built wheels to Pypi
+    runs-on: ubuntu-latest
+    environment: release
+    needs: [build, sdist]
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+
+      - name: Copy artifacts to dist/ folder
+        run: |
+          find . -name 'artifact-*' -exec unzip '{}' \;
+          mkdir -p dist/
+          find . -name '*.tar.gz' -exec mv '{}' dist/ \;
+          find . -name '*.whl' -exec mv '{}' dist/ \;
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        name: Publish to PyPI