PYTHON-4107 [python-bsonjs] Use PyPI Trusted Publishing (#52)

* PYTHON-4107 [python-bsonjs] Use PyPI Trusted Publishing

* update codeowners

* update action versions

Author: blink1073

.github/CODEOWNERS

@@ -1,2 +1,2 @@
 # Global owner for repo
-* @blink1073 @juliusgeo @ShaneHarvey
+* @mongodb-labs/dbx-python

.github/workflows/release-python.yml

@@ -2,38 +2,39 @@ name: Python Wheels
 
 on:
   push:
-    branches: ["master"]
     tags:
-      - "**"
+      - "[0-9]+.[0-9]+.[0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+.post[0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+[a-b][0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
   pull_request:
   workflow_dispatch:
 
 concurrency:
   group: wheels-${{ github.ref }}
   cancel-in-progress: true
 
-
 jobs:
-  build-wheels:
+  build_wheels:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [macos-latest, windows-2019, ubuntu-latest]
     name: Build CPython ${{ matrix.python-version }}-${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - uses: pypa/cibuildwheel@v2.11.2
         env:
           CIBW_ARCHS_MACOS: x86_64 universal2
           CIBW_TEST_SKIP: '*universal2:arm64'
           CIBW_BUILD: "cp37-macosx_x86_64 cp38-macosx_universal2 cp37-win* cp37-manylinux_{x86_64,i686}"
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
           name: python_bsonjs-3.7-${{ matrix.os }}-wheel
           path: ./wheelhouse/*.whl
           if-no-files-found: error
-  test-non-linux-wheels:
-    needs: build-wheels
+  test_non_linux_wheels:
+    needs: build_wheels
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
@@ -58,9 +59,9 @@ jobs:
           python -m pip list | grep python-bsonjs
           python -c "from bsonjs import dumps"
   # Linux
-  test-manylinux-wheels:
+  test_manylinux_wheels:
     runs-on: ${{ matrix.os }}
-    needs: build-wheels
+    needs: build_wheels
     strategy:
       matrix:
         os: [ubuntu-latest]
@@ -80,25 +81,42 @@ jobs:
     name: Make SDist
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Build SDist
         run: python setup.py sdist --dist-dir=dist --formats=gztar
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
           name: "sdist"
           path: dist/*.tar.gz
-  collect-wheels:
+  collect_dist:
     runs-on: ubuntu-latest
-    needs: [build-wheels, make_sdist]
+    needs: [build_wheels, make_sdist]
     name: Download Wheels
     steps:
       - name: Download all workflow run artifacts
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
       - name: Flatten directory
+        working-directory: .
         run: |
           find . -mindepth 2 -type f -exec mv {} . \;
           find . -type d -empty -delete
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
-          name: all-dist
-          path: "./*"
+          name: all-dist-${{ github.head_ref || github.ref_name }}
+          path: "./*"
+  publish:
+    # https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#publishing-the-distribution-to-pypi
+    needs: [collect_dist]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v3
+      with:
+        name: all-dist-${{ github.head_ref || github.ref_name }}
+        path: dist/
+    - name: Publish distribution 📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools"]
+requires = ["setuptools>=62.0"]
 build-backend = "setuptools.build_meta"
 
 [project]