Update the publish workflow

.github/workflows/publish.yml

@@ -6,36 +6,49 @@ on:
       - "v*.*.*"
 
 jobs:
-  build-and-publish:
+  build-package:
     runs-on: ubuntu-latest
-    environment:
-      name: pypi
-      url: https://pypi.org/p/cleanpy
+    container:
+      image: ghcr.io/thombashi/python-ci:3.11
 
     steps:
     - uses: actions/checkout@v4
 
-    - name: Setup Python
-      uses: actions/setup-python@v4
+    - run: make build
+
+    - uses: actions/upload-artifact@v4
       with:
-        python-version: "3.11"
-        cache: pip
-        cache-dependency-path: |
-          setup.py
-          **/*requirements.txt
-          tox.ini
+        name: dist
+        path: ./dist/*
 
-    - run: make setup-ci
+  publish-package:
+    needs: build-package
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/cleanpy
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+      contents: write
 
-    - run: make build
+    steps:
+    - uses: actions/download-artifact@v4
+      with:
+        name: dist
+        path: ./dist
 
     - name: Publish to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
+
+    - name: Sign the dists with Sigstore
+      uses: sigstore/[email protected]
       with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}
+        inputs: >-
+          ./dist/*.tar.gz
+          ./dist/*.whl
 
     - name: Generate a GitHub release
       uses: softprops/action-gh-release@v2
       with:
         generate_release_notes: true
+        files: dist/*