update publish ci to use pypi publisher (unionai-oss#1922)

* testing publish ci

Signed-off-by: cosmicBboy <[email protected]>

* debug

Signed-off-by: cosmicBboy <[email protected]>

* finalize publish workflow

Signed-off-by: cosmicBboy <[email protected]>

---------

Signed-off-by: cosmicBboy <[email protected]>
Signed-off-by: Matt Richards <[email protected]>

Author: cosmicBboy

.github/workflows/publish.yml

@@ -3,12 +3,9 @@ name: Publish Python Package
 on:
   release:
     types: [published]
-  push:
-    branches:
-      - update-publish-ci
 
 jobs:
-  publish:
+  build_wheel_and_sdist:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -25,10 +22,25 @@ jobs:
       - name: Build wheel and sdist
         run: python -m build
         shell: bash
-      - name: Build and publish
-        run: ls -la .
-      # - name: Build and publish
-      #   env:
-      #     TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-      #     TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-      #   run: twine upload dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: pandera-artifact
+          path: ./dist
+
+  pypi-publish:
+    name: Upload release to PyPI
+    needs: [build_wheel_and_sdist]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
+    environment: release
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: pandera-artifact
+          path: dist
+      - run: ls dist
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: false