PYTHON-4106 [winkerberos] Use PyPI Trusted Publishing (#59)

* PYTHON-4106 [winkerberos] Use PyPI Trusted Publishing

* keep wheel building on PRs

Author: blink1073

.github/workflows/release.yml renamed to .github/workflows/release-python.yml

@@ -1,6 +1,14 @@
 name: Python Wheels
 
-on: [push, pull_request]
+on:
+  push:
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+.post[0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+[a-b][0-9]+"
+      - "[0-9]+.[0-9]+.[0-9]+rc[0-9]+"
+  workflow_dispatch:
+  pull_request:
 
 concurrency:
   group: release-${{ github.ref }}
@@ -43,18 +51,36 @@ jobs:
           name: "sdist"
           path: dist/*.zip
 
-  collect_wheels:
+  collect_dist:
     runs-on: ubuntu-latest
     needs: [build_wheels, make_sdist]
     name: Download Wheels
     steps:
       - name: Download all workflow run artifacts
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
       - name: Flatten directory
+        working-directory: .
         run: |
           find . -mindepth 2 -type f -exec mv {} . \;
           find . -type d -empty -delete
-      - uses: actions/upload-artifact@v2
+      - uses: actions/upload-artifact@v3
         with:
-          name: all-dist
+          name: all-dist-${{ github.head_ref || github.ref_name }}
           path: "./*"
+
+  publish:
+    # https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#publishing-the-distribution-to-pypi
+    needs: [collect_dist]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
+    steps:
+    - name: Download all the dists
+      uses: actions/download-artifact@v3
+      with:
+        name: all-dist-${{ github.head_ref || github.ref_name }}
+        path: dist/
+    - name: Publish distribution 📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1