Update `publish.yaml` with latest PyPI recommendations (#3011)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 49ba9f3b3997c975a39c33fd27eadac590df04ab..6bc9b2d21ccdeca2e3643d24d821711bcfe6f7e4 100644 (file)
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,12 +6,8 @@ on:
       - '*'
 
 jobs:
-  publish:
-    name: "Publish release"
-    runs-on: "ubuntu-latest"
-
-    environment:
-      name: deploy
+  build:
+    runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -22,14 +18,71 @@ jobs:
           python-version: "3.11"
           enable-cache: true
 
-      - name: "Install dependencies"
+      - name: Install dependencies
         run: scripts/install
 
-      - name: "Build package & docs"
+      - name: Build package & docs
         run: scripts/build
 
-      - name: "Publish to PyPI & deploy docs"
-        run: scripts/publish
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+      - name: Upload package distributions
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: package-distributions
+          path: dist/
+
+      - name: Upload documentation
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: documentation
+          path: site/
+
+  pypi-publish:
+    runs-on: ubuntu-latest
+    needs: build
+
+    permissions:
+      id-token: write
+
+    environment:
+      name: pypi
+      url: https://pypi.org/project/starlette
+
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: package-distributions
+          path: dist/
+
+      - name: Publish distribution 📦 to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+
+  docs-publish:
+    runs-on: ubuntu-latest
+    needs: build
+
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Download artifacts
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: documentation
+          path: site/
+
+      - name: Configure Git Credentials
+        run: |
+          git config user.name github-actions[bot]
+          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+
+      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        run: scripts/install
+
+      - name: Publish documentation 📚 to GitHub Pages
+        run: mkdocs gh-deploy --force