Add trusted publishing workflows

[Zeitsperre]

Overview

This PR implements Trusted Publishing, which is a more automated and secure method for deploying packages from GitHub to TestPyPI/PyPI.

The workflows are triggered by tags (TestPyPI) and releases (PyPI). When a trigger occurs, GitHub Workflows automatically generates packages (wheel and sdist) and a short-lived access token with the index and then deploys the package for publishing.

As an extra security measure, each workflow relies on an environment for deployment (staging and production, already configured). The only rules so far are that a "release" deployment to PyPI must be given the OK from an existing owner (@cehbrecht, @jachym, or @jorgejesus) before a package is built and deployed.

The workflows use the build package to prepare the sdist and wheel.

Related Issue / Discussion

Closes #708

Additional Information

I've created an entry for PyWPS on TestPyPI by uploading the last stable version (4.7.0). @cehbrecht has received an invitation as owner, but if the other owners would like access, they will need to make an account on that index. Let me know if you do.

Contribution Agreement

(as per https://github.com/geopython/pywps/blob/master/CONTRIBUTING.rst#contributions-and-licensing)

• I'd like to contribute [feature X|bugfix Y|docs|something else] to PyWPS. I confirm that my contributions to PyWPS will be compatible with the PyWPS license guidelines at the time of contribution.
• I have already previously agreed to the PyWPS Contributions and Licensing Guidelines

[coveralls]

coverage: 80.697%. remained the same — add-trusted-publishing into main

[cehbrecht]

@Zeitsperre sorry ... I was too late for the invite to accept. Can you send it again?

[Zeitsperre]

@cehbrecht All good. Invite sent!

[Zeitsperre]

One thing I forgot to mention is that the Publishing workflow needs to be configured by an owner/maintainer on PyPI: https://docs.pypi.org/trusted-publishers/adding-a-publisher/

The information needed is as follows:

• owner: geopython
• repository name: pywps
• workflow name: publish-pypi.yml
• environment name: production

[cehbrecht]

@Zeitsperre I'm a maintainer on pypi for pywps ... but the "manage" button is disabled.

@tomkralidis is pywps managed via geopython?

[tomkralidis]

@Zeitsperre I'm a maintainer on pypi for pywps ... but the "manage" button is disabled.

@tomkralidis is pywps managed via geopython?

@cehbrecht it turns out you did not have "Owner" privs in PyPI on PyWPS. I've enabled this just now, let me know if this helps/works.

[Zeitsperre]

@cehbrecht Once the workflow is set up on PyPI, we can merge this PR and create a release. Afterwards, it'll be a cinch to close #705.

[cehbrecht]

@tomkralidis thanks. it worked :)

@Zeitsperre ... I have added the trusted publisher on pypi now.

[Zeitsperre]

@cehbrecht Awesome, I just need someone to approve this PR.