Switch to PyPI's Trusted Publishers for more secure upload.

• First, format pyproject.toml for easy comparison with other projects.

• Switch backend to hatch with the hatch_vcs plugin to enable publishing to Test PyPI.

• Add new deploy workflow using https://github.com/hynek/build-and-inspect-python-package to confirm we can build packages and inspect as desired. Done for all runs, but not uploaded yet.

• Upload to Test PyPI on every commit on main.

• Upload to real PyPI on GitHub Releases.

• Remove old release job.

TODO:

• Set up Trusted Publisher on https://test.pypi.org/project/cherry_picker/
• Set up Trusted Publisher on https://pypi.org/project/cherry_picker/
• Once confirmed working, delete PYPI_TOKEN from this repo secrets, it's no longer needed.
• Once all working, I'll create a release checklist in another PR.

hugovk left a comment •

Loading

(oops, this was meant to be a commit messages)