ci: fully revamp the python publish workflow

 - trigger the publication by pushing a tag matching vN.*
 - use workflow_call to make all the workflows DRYer
 - use the more modern ways to publish
 - sign the dist files in the GH release

These changes are based on similar changes make EveryVoice by Samuel Larkin
and Aidan Pine.

.github/workflows/docs.yml

@@ -1,5 +1,6 @@
 name: Deploy docs
 on:
+  workflow_call:
   push:
     branches:
       - main
@@ -30,3 +31,8 @@ jobs:
         run: |
           mkdocs build
           mike deploy --push --update-aliases latest
+      - name: Store the docs
+        uses: actions/upload-artifact@v4
+        with:
+          name: latest-docs
+          path: site/

.github/workflows/pythonpublish.yml

@@ -1,36 +1,131 @@
-# This workflows will upload a Python Package using Twine when a release is created
-# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries
+# To create a release:
+#  - update the version number in g2p/_version.py
+#  - commit the changes
+#  - create an annotated tag with the version number, e.g.: git tag -a v2.0.1 -m "v2.0.1"
+#  - push the tag, which will trigger this pythonpublish release workflow
+
+name: Publish g2p to PyPI and create a GitHub release
 
-name: Upload Python Package
 on:
   push:
-    branches: [ release ]
+    tags:
+      - v[0-9]+.**
+
 jobs:
-  deploy:
+  tests:
+    uses: ./.github/workflows/tests.yml
+    secrets: inherit
+
+  build-docs:
+    uses: ./.github/workflows/docs.yml
+    needs: tests
+    secrets: inherit
+
+  build:
     runs-on: ubuntu-latest
+    needs: tests
     steps:
     - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0 # fetch all commits/branches
     - name: Set up Python
       uses: actions/setup-python@v5
       with:
         python-version: '3.x'
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install build twine
-        pip install -e .
-    - name: Install documentation dependencies
+    - name: Install build tool
+      run: pip install build
+    - name: Build a binary wheel and a source tarball
+      run: python -m build --sdist --wheel
+    - name: Store the distribution packages
+      uses: actions/upload-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+
+  github-release:
+    name: Make a signed GitHub release
+    needs:
+      - tests
+      - build
+      - build-docs
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write  # IMPORTANT: mandatory for making GitHub Releases
+      id-token: write  # IMPORTANT: mandatory for sigstore
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Sign the dists with Sigstore
+      uses: sigstore/[email protected]
+      with:
+        inputs: >-
+          ./dist/*.tar.gz
+          ./dist/*.whl
+    - name: Update CHANGELOG
+      id: changelog
+      uses: requarks/changelog-action@v1
+      with:
+        token: ${{ github.token }}
+        tag: ${{ github.ref_name }}
+    - name: Create Release
+      uses: ncipollo/[email protected]
+      with:
+        allowUpdates: true
+        name: ${{ github.ref_name }}
+        tag: ${{ github.ref_name }}
+        body: ${{ steps.changelog.outputs.changes }}
+        token: ${{ github.token }}
+
+  deploy-docs:
+    runs-on: ubuntu-latest
+    needs:
+      - build-docs
+      - github-release
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: gh-pages
+    - name: Download the latest docs
+      uses: actions/download-artifact@v4
+      with:
+        name: latest-docs
+        path: site/
+    - name: Setup doc deploy
       run: |
-        pip install -r docs/requirements.txt
-    - name: Build and publish
-      env:
-        TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
+        git config user.name 'github-actions[bot]'
+        git config user.email 'github-actions[bot]@users.noreply.github.com'
+    - name: Deploy docs with mike 🚀
       run: |
-        python -m build --sdist --wheel
-        twine upload dist/*
+        mike deploy --push --update-aliases latest ${{ github.ref_name }} stable
+
+  publish-to-pypi:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    needs: github-release
+    environment:
+      name: pypi
+      url: https://pypi.org/p/g2p
+    permissions:
+      id-token: write  # IMPORTANT: mandatory for trusted publishing
+    steps:
+    - name: Download the distribution packages
+      uses: actions/download-artifact@v4
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Publish distribution 📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        password: ${{ secrets.PYPI_API_TOKEN }}
+        verbose: true
+
+  # Convertextract depends on g2p<2.0, maybe this is no longer relevant?
+  # Or do we want to keep it because eventually convertextract will depend on g2p>=2.0?
+  trigger-convertextract-build:
+    runs-on: ubuntu-latest
+    needs: publish-to-pypi
+    steps:
     - name: trigger convertextract build
       run: |
         curl --location --request POST 'https://api.github.com/repos/roedoejet/convertextract/dispatches' \
@@ -42,28 +137,3 @@ jobs:
           "event_type": "g2p-published",
           "client_payload": {}
         }'
-    - name: Determine tag
-      id: determine_tag
-      run: |
-        echo "TAG_VERSION=$(ls dist/g2p-*.tar.gz | sed -e 's/.*g2p-//' -e 's/.tar.gz.*//')" >> $GITHUB_OUTPUT
-    - name: Bump version and push tag
-      id: tag_version
-      uses: mathieudutour/[email protected]
-      with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-        custom_tag: ${{ steps.determine_tag.outputs.TAG_VERSION }}
-        create_annotated_tag: true
-    - name: Create a GitHub release
-      uses: ncipollo/release-action@v1
-      with:
-        tag: ${{ steps.tag_version.outputs.new_tag }}
-        name: Release ${{ steps.tag_version.outputs.new_tag }}
-        body: ${{ steps.tag_version.outputs.changelog }}
-    - name: Setup doc deploy
-      run: |
-        git config user.name 'github-actions[bot]'
-        git config user.email 'github-actions[bot]@users.noreply.github.com'
-    - name: Deploy docs with mike 🚀
-      run: |
-        mkdocs build
-        mike deploy --push --update-aliases latest ${{ steps.tag_version.outputs.new_tag }} stable

.github/workflows/tests.yml

@@ -2,6 +2,7 @@ name: Run all tests
 on:
   - pull_request
   - push
+  - workflow_call
 
 jobs:
   test-all-on-linux: