feat: pypi trusted publishing

.github/workflows/publish-pypi.yaml

@@ -0,0 +1,37 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types:
+      - published
+
+jobs:
+  # Publication isn't necessary for prereleases
+  check-eligible:
+    if: github.repository == 'ppfeister/sylva'
+    name: Check publication eligibility
+    runs-on: ubuntu-latest
+    outputs:
+      is-prerelease: ${{ steps.release-type.outputs.is-prerelease }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: release-type
+        run: |
+          if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
+            echo "is-prerelease=true" >> $GITHUB_OUTPUT
+          else
+            echo "is-prerelease=false" >> $GITHUB_OUTPUT
+          fi
+
+  publish-pypi:
+    needs: check-eligible
+    if: needs.check-eligible.outputs.is-prerelease == 'false'
+    name: Build and publish to PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pdm-project/setup-pdm@v4
+      - name: Build and publish distribution
+        run: pdm publish