Setup trusted publishing for testing.

The old deployment is kept in case anything breaks.
That will be removed once this looks good.

Author: HexDecimal

.github/workflows/python-package.yml

@@ -297,3 +297,61 @@ jobs:
           TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
           TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
         run: twine upload --skip-existing wheelhouse/*
+
+  publish:
+      needs: [build]
+      runs-on: ubuntu-latest
+      if: startsWith(github.ref, 'refs/tags/')
+      environment:
+        name: release
+        url: https://pypi.org/p/tcod
+      permissions:
+        id-token: write
+      steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: sdist
+          path: dist/
+      - uses: actions/download-artifact@v3
+        with:
+          name: wheels-windows
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true
+
+  publish-macos:
+    needs: [build-macos]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    environment:
+      name: release
+      url: https://pypi.org/p/tcod
+    permissions:
+      id-token: write
+    steps:
+    - uses: actions/download-artifact@v3
+      with:
+        name: wheels-macos
+        path: dist/
+    - uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        skip-existing: true
+
+  publish-linux:
+    needs: [linux-wheels]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    environment:
+      name: release
+      url: https://pypi.org/p/tcod
+    permissions:
+      id-token: write
+    steps:
+    - uses: actions/download-artifact@v3
+      with:
+        name: wheels-linux
+        path: dist/
+    - uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        skip-existing: true