OIDC-based test releases

.github/workflows/EVENT_release.yml

@@ -83,6 +83,8 @@ jobs:
     needs: [run_tests, run_e2e]
     if: startsWith(github.ref, 'refs/tags/test-')
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -97,24 +99,17 @@ jobs:
         uses: abatilo/actions-poetry@v2
         with:
           poetry-version: "1.3.1"
-      - name: Check secrets are set
-        run: |
-          if [[ -z "${{ secrets.TEST_PYPI_USERNAME }}" || -z "${{ secrets.TEST_PYPI_PASSWORD }}" ]]; then
-            echo "TEST_PYPI_USERNAME and TEST_PYPI_PASSWORD must be set"
-            exit 1
-          fi
-      - name: Publish on test.pypi.org
-        env:
-          POETRY_HTTP_BASIC_PYPI_USERNAME: ${{ secrets.TEST_PYPI_USERNAME }}
-          POETRY_HTTP_BASIC_PYPI_PASSWORD: ${{ secrets.TEST_PYPI_PASSWORD }}
+      - name: Build package
         run: |
           python ./deploy/nightly_package_setup.py
-          poetry config repositories.test-pypi https://test.pypi.org/legacy/
-          poetry config http-basic.test-pypi ${{ secrets.TEST_PYPI_USERNAME }} ${{ secrets.TEST_PYPI_PASSWORD }}
-
-          poetry publish --build --repository test-pypi
+          poetry build
           python ./deploy/revert_nightly_setup.py
 
+      - name: Publish to Test PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
   notify_release:
     needs: [release]
     if: success()

.github/workflows/JOB_tests.yml

@@ -34,7 +34,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install dependencies with retry
-        uses: nick-invision/retry@v3
+        uses: nick-invision/retry@7152eba30c6575329ac0576536151aca5a72780e
         with:
           timeout_minutes: 10
           max_attempts: 3