Bump lsst-sqre/build-and-publish-to-pypi from 1 to 2

[dependabot]

Bumps lsst-sqre/build-and-publish-to-pypi from 1 to 2.

Release notes

Sourced from lsst-sqre/build-and-publish-to-pypi's releases.

v2.0.0

This release adopts PyPI's trusted publisher program. The pypi-token input for the action is removed entirely.

Upgrade process

Setting up a package's trusted publishing process requires three steps: registering the trusted publisher on PyPI, creating the deployment environment in your GitHub repository's settings, and finally updating to this new lsst-sqre/build-and-publish-to-pypi@v2 action (dropping the pypi-token input).

See this action's README for details.

What's Changed

• DM-39837: Adopt PyPI's trusted publisher program (for v2) by @​jonathansick in lsst-sqre/build-and-publish-to-pypi#5

Full Changelog: lsst-sqre/build-and-publish-to-pypi@v1...v2.0.0

v1.2.0

This release adds a working-directory input to set the root directory of the Python package that's being built and published. This setting is useful for monorepos. The default is the root directory, which is the existing behaviour.

What's Changed

• DM-39050: Add working-directory input by @​jonathansick in lsst-sqre/build-and-publish-to-pypi#4

Full Changelog: lsst-sqre/build-and-publish-to-pypi@v1...v1.2.0

v1.1.0

The new upload input for the action defaults to true, but can be toggled to false to disable uploads to PyPI. When upload is false, the action runs an additional step with twine check to validate the distributions. Hence this action can be used pull request workflows to ensure that the package builds and has valid metadata.

An example of uploading to PyPI only for tag pushes:

name: Python CI
"on":
push:
tags:
- "*"
pull_request: {}
jobs:
pypi:
runs-on: ubuntu-latest
steps:

uses: actions/checkout@v3
with:
fetch-depth: 0 # full history for setuptools_scm


</tr></table>

... (truncated)

Commits

• 7fa391d Merge pull request #5 from lsst-sqre/tickets/DM-39837
• facb570 Update examples to use v2 of this action
• de414b4 Improve documentation
• 4c6e9e7 Document usage of environments
• ebc660f Switch usage to use GitHub Release trigger
• 1ca1d98 Drop pypi-token input
• c1f090b Update copyright for 2023
• ae8090b Update pre-commit hooks
• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.