Fix release workflow

[A5rocks]

I made the release locally before noticing that we set up trusted publishers, but approving it I noticed a few things too:

• it required approval to build the dist (it should only use the environment=only require approval to actually release)
• it got this error when actually releasing:

Checking dist/trustme-1.2.1-py3-none-any.whl: ERROR    InvalidDistribution: Metadata is missing required fields: Name,        
         Version.                                                               
         Make sure the distribution includes the files where those fields are   
         specified, and is using a supported Metadata-Version: 1.0, 1.1, 1.2,   
         2.0, 2.1, 2.2, 2.3.                                                    

Not sure why! It worked locally just with:

(release-venv) PS C:\Users\A5rocks\Documents\trustme> git clean -xdf
Removing .venv/
(release-venv) PS C:\Users\A5rocks\Documents\trustme> python -m build
* Creating isolated environment: venv+pip...
* Installing packages in isolated environment:
  - hatchling
* Getting build dependencies for sdist...
* Building sdist...
* Building wheel from sdist
* Creating isolated environment: venv+pip...
* Installing packages in isolated environment:
  - hatchling
* Getting build dependencies for wheel...
* Building wheel...
Successfully built trustme-1.2.1.tar.gz and trustme-1.2.1-py3-none-any.whl
(release-venv) PS C:\Users\A5rocks\Documents\trustme> twine upload dist/*
Uploading distributions to https://upload.pypi.org/legacy/
Enter your API token:
Uploading trustme-1.2.1-py3-none-any.whl
100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 26.0/26.0 kB • 00:00 • 7.9 MB/s
Uploading trustme-1.2.1.tar.gz
100% ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 36.3/36.3 kB • 00:00 • 8.4 MB/s

View at:
https://pypi.org/project/trustme/1.2.1/

[A5rocks]

If this worked before, it's possible that me having already published the release messed things up....

[pquentin]

Thanks for the release! And no worries about doing it locally; I'm sorry I deviated from the general Trio process without sharing it or documenting it more widely. The error you got is related to the Core metadata 2.4 rollout and can be fixed using more recent twine/pkginfo versions. See urllib3/urllib3#3531 for an example. However, we don't pin those versions anywhere, so there's nothing actionable for us here.

I opened #674 for the environment fix. Nice catch, thank you!

[A5rocks]

However, we don't pin those versions anywhere, so there's nothing actionable for us here.

Looking at the github action workflow files, it looks like you might need to bump the pypa/gh-action-pypi-publish action? Maybe even enable dependabot for github action.