Set up trusted publishing from GHA

- Add build to dev deps
- Add sdist job to build sdist
- Add publish job to publish tagged releases

.github/workflows/ci.yml

@@ -0,0 +1,74 @@
+name: CI
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - v*
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
+        os: [macOS-latest, ubuntu-latest, windows-latest]
+
+    env:
+      UV_SYSTEM_PYTHON: 1
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set Up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          allow-prereleases: true
+      - uses: hynek/setup-cached-uv@v2
+        with:
+          cache-dependency-path: pyproject.toml
+      - name: Install
+        run: make EXTRAS=dev install
+      - name: Test
+        run: make test
+      - name: Lint
+        run: make lint
+
+  sdist:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - uses: hynek/setup-cached-uv@v2
+        with:
+          cache-dependency-path: pyproject.toml
+      - name: Install
+        run: make install
+      - name: Build
+        run: python -m build --sdist
+      - name: Upload
+        uses: actions/upload-artifact@v3
+        with:
+          name: sdist
+          path: dist
+
+  publish:
+    needs: sdist
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: sdist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@release/v1

makefile

@@ -1,8 +1,8 @@
 PKG:=aioitertools
 EXTRAS:=dev,docs
 
-UV_VERSION:=$(shell uv --version)
-ifdef UV_VERSION
+UV:=$(shell uv --version)
+ifdef UV
 	VENV:=uv venv
 	PIP:=uv pip
 else

pyproject.toml

@@ -22,6 +22,7 @@ dependencies = ["typing_extensions>=4.0; python_version < '3.10'"]
 dev = [
     "attribution==1.8.0",
     "black==24.8.0",
+    "build>=1.2",
     "coverage==7.6.1",
     "flake8==7.1.1",
     "flit==3.9.0",
@@ -60,4 +61,4 @@ skip_covered = true
 
 [tool.mypy]
 # strict = true
-ignore_missing_imports = true
+ignore_missing_imports = true