Modernize release GitHub Actions workflow

Add explicit permissions (id-token: write, contents: read) and restructure steps for clarity. Replace legacy pip-based build/publish (setuptools/wheel/twine) with python -m build and the pypa/gh-action-pypi-publish action, and add a dedicated Build step. Preserve the existing version-bump check logic and only run publish/release steps when the package version has changed. Overall changes improve security and simplify publishing.

Author: kozo2

.github/workflows/release.yml

@@ -9,47 +9,55 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # needed for Trusted Publishing
+      contents: read
+
     steps:
-    - uses: actions/checkout@v4
-    - name: Check version bump
-      id: version_check
-      run: |
-        NEW_VERSION=$(python -c "import re; print(re.search(r\"version='([^']+)'\", open('setup.py').read()).group(1))")
-        echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
-        pip install ecell4 2>/dev/null && \
-          CURRENT_VERSION=$(pip show ecell4 | grep ^Version | awk '{print $2}') || \
-          CURRENT_VERSION="0.0.0"
-        if [ "$NEW_VERSION" = "$CURRENT_VERSION" ]; then
-          echo "changed=false" >> "$GITHUB_OUTPUT"
-        else
-          echo "changed=true" >> "$GITHUB_OUTPUT"
-        fi
-    - name: Set up Python
-      if: steps.version_check.outputs.changed == 'true'
-      uses: actions/setup-python@v5
-      with:
-        python-version: '3.x'
-    - name: Install dependencies
-      if: steps.version_check.outputs.changed == 'true'
-      run: |
-        python -m pip install --upgrade pip
-        pip install setuptools wheel twine
-    - name: Build and publish to PyPI
-      if: steps.version_check.outputs.changed == 'true'
-      env:
-        TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-      run: |
-        python setup.py sdist bdist_wheel
-        twine upload dist/*
-    - name: Create GitHub Release
-      if: steps.version_check.outputs.changed == 'true'
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        VERSION=${{ steps.version_check.outputs.version }}
-        git tag "v${VERSION}"
-        git push origin "v${VERSION}"
-        gh release create "v${VERSION}" dist/* \
-          --title "v${VERSION}" \
-          --generate-notes
+      - uses: actions/checkout@v4
+
+      - name: Check version bump
+        id: version_check
+        run: |
+          NEW_VERSION=$(python -c "import re; print(re.search(r\"version='([^']+)'\", open('setup.py').read()).group(1))")
+          echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
+          pip install ecell4 2>/dev/null && \
+            CURRENT_VERSION=$(pip show ecell4 | grep ^Version | awk '{print $2}') || \
+            CURRENT_VERSION="0.0.0"
+          if [ "$NEW_VERSION" = "$CURRENT_VERSION" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up Python
+        if: steps.version_check.outputs.changed == 'true'
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
+      - name: Install build tooling
+        if: steps.version_check.outputs.changed == 'true'
+        run: |
+          python -m pip install --upgrade pip
+          pip install build
+
+      - name: Build
+        if: steps.version_check.outputs.changed == 'true'
+        run: python -m build
+
+      - name: Publish to PyPI
+        if: steps.version_check.outputs.changed == 'true'
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+      - name: Create GitHub Release
+        if: steps.version_check.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION=${{ steps.version_check.outputs.version }}
+          git tag "v${VERSION}"
+          git push origin "v${VERSION}"
+          gh release create "v${VERSION}" dist/* \
+            --title "v${VERSION}" \
+            --generate-notes