Switch to Trusted Publishing for publishing packages to PyPI

Author: dataflake

.github/workflows/tests.yml

@@ -66,3 +66,64 @@ jobs:
         uvx coveralls --service=github
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Build package artifacts
+      if: >
+        matrix.os[0] == 'ubuntu'
+        && matrix.config[1] == 'py314'
+      run: |
+        rm -f dist/*
+        pip install -U packaging "setuptools >= 78.1.1,< 82" wheel twine
+        python setup.py sdist
+        python setup.py bdist_wheel
+
+    - name: Upload package wheel
+      if: >
+        matrix.os[0] == 'ubuntu'
+        && matrix.config[1] == 'py314'
+      uses: actions/upload-artifact@v7
+      with:
+        name: Zope.whl
+        path: dist/*whl
+
+    - name: Upload package source distribution
+      if: >
+        matrix.os[0] == 'ubuntu'
+        && matrix.config[1] == 'py314'
+      uses: actions/upload-artifact@v7
+      with:
+        name: Zope.tar.gz
+        path: dist/*gz
+
+  publish:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    # Only publish on tag pushes
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    # Wait for build jobs to complete
+    needs: [build]
+    environment:
+      name: pypi
+      url: https://pypi.org/p/Zope
+    permissions:
+      contents: read
+      id-token: write  # Mandatory for trusted publishing
+
+    steps:
+      - name: Download package artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: dist/
+          pattern: '*'
+          merge-multiple: true
+
+      - name: Display structure of downloaded files
+        run: |
+          ls -lR dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true
+          packages-dir: dist/
+          verbose: true

.meta.toml

@@ -2,7 +2,7 @@
 # https://github.com/zopefoundation/meta/tree/master/src/zope/meta/zope-product
 [meta]
 template = "zope-product"
-commit-id = "ba10c93f"
+commit-id = "4a693eeb"
 
 [python]
 with-pypy = false
@@ -112,3 +112,6 @@ ignore = [
 
 [pre-commit]
 teyit-exclude = "App/tests/fixtures/error\\.py"
+
+[pypi]
+trusted-publishing = true

CHANGES.rst

@@ -14,6 +14,8 @@ https://github.com/zopefoundation/Zope/blob/5.x/CHANGES.rst.
 
 - Update to newest compatible versions of dependencies.
 
+- Switch to Trusted Publishing for publishing packages to PyPI.
+
 
 6.1 (2026-04-22)
 ----------------

docs/maintenance.rst

@@ -60,21 +60,11 @@ Steps for creating a new Zope release
 
 - If the tests succeed, commit the changes.
 
-- Clear out documentation build artifacts to prevent adding these files to
-  the package::
-
-   $ rm -rf docs/_build
-
-- Upload the tagged release to PyPI::
-
-    $ bin/release  # if you use zest.releaser
-
-    or
+- Create and push the release tag. This will trigger the publishing workflow on
+  GitHub::
 
     $ git tag -as <TAG-NAME> -m "- tagging release <TAG-NAME>"
     $ git push --tags
-    $ bin/buildout setup setup.py sdist bdist_wheel
-    $ bin/twine upload dist/Zope-<TAG-NAME>*
 
 - Update version information in the change log and ``pyproject.toml``::
 
@@ -91,7 +81,12 @@ Steps for creating a new Zope release
 
 - Commit and push the changes.
 
-- Check that the changes have been propagated to https://zope.readthedocs.io/en/latest/changes.html.
+- Check that the package publishing workflow has succeeded at 
+  https://github.com/zopefoundation/Zope/actions and
+  https://pypi.org/project/Zope/#history
+
+- Check that the changes have been propagated to 
+  https://zope.readthedocs.io/en/latest/changes.html.
   (This should be done automatically via web hooks defined in GitHub and RTD.)
 
 - Update https://zopefoundation.github.io/Zope/::

pyproject.toml

@@ -2,7 +2,7 @@
 # https://github.com/zopefoundation/meta/tree/master/src/zope/meta/zope-product
 [build-system]
 requires = [
-    "setuptools >= 78.1.1,< 81",
+    "setuptools >= 78.1.1,< 82",
     "wheel",
 ]
 build-backend = "setuptools.build_meta"
@@ -155,3 +155,7 @@ directory = "parts/htmlcov"
 
 [tool.setuptools.dynamic]
 readme = {file = ["README.rst", "CHANGES.rst"]}
+
+[tool.zest-releaser]
+create-wheel = false
+upload-pypi = false

setup.cfg

@@ -1,6 +1,5 @@
 # Generated with zope.meta (https://zopemeta.readthedocs.io/) from:
 # https://github.com/zopefoundation/meta/tree/master/src/zope/meta/zope-product
-
 [flake8]
 doctests = 1
 no-accept-encodings = True

tox.ini

@@ -16,7 +16,7 @@ envlist =
 [testenv]
 skip_install = true
 deps =
-    setuptools >= 78.1.1,< 81
+    setuptools >= 78.1.1,< 82
     zc.buildout
     wheel
 setenv =
@@ -39,7 +39,7 @@ description = ensure that the distribution is ready to release
 basepython = python3
 skip_install = true
 deps =
-    setuptools >= 78.1.1,< 81
+    setuptools >= 78.1.1,< 82
     wheel
     twine
     build