Do PyPI release in GitHub Actions (#155)

This workflow is based on https://learn.scientific-python.org/development/guides/gha-pure/

This introduces GitHub Actions (GHA), alongside CircleCI. An additional integration is not ideal, but this gets us some community-supported tooling and more secure handshaking between GitHub and PyPI for publishing via "Trusted Publisher" so we don't need to manage secrets: https://docs.pypi.org/trusted-publishers/

Co-authored-by: Rob Brackett <rob@robbrackett.com>

.circleci/config.yml

@@ -101,27 +101,6 @@ jobs:
             . ~/venv/bin/activate
             flake8 .
 
-  build:
-    working_directory: ~/wayback
-    docker:
-      - image: cimg/python:3.12
-    steps:
-      - checkout
-      - setup_pip:
-          python-version: "3.12"
-          install-dev: true
-      - run:
-          name: Build Distribution
-          command: |
-            . ~/venv/bin/activate
-            python -m build .
-      - run:
-          name: Check Distribution
-          command: |
-            . ~/venv/bin/activate
-            twine check dist/*
-            check-wheel-contents dist
-
   # NOTE: The docs are mainly built and published directly by readthedocs.com.
   # This job is meant to verify there are no issues with the docs and it is NOT
   # responsible for building what actually gets published. (Readthedocs.com
@@ -151,5 +130,4 @@ workflows:
               python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
               urllib3-version: ["1.20", "2.0"]
       - lint
-      - build
       - docs

.github/workflows/cd.yml

@@ -0,0 +1,38 @@
+name: CD
+
+on:
+  workflow_dispatch: {}
+  pull_request: {}
+  push:
+    branches:
+      - main
+  release:
+    types:
+      - published
+
+jobs:
+  dist:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: hynek/build-and-inspect-python-package@v2
+
+  publish:
+    needs: [dist]
+    environment: pypi
+    permissions:
+      id-token: write
+    runs-on: ubuntu-latest
+    if: github.event_name == 'release' && github.event.action == 'published'
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
+