Add release workflow (#329)

* Add release workflow

* Use GitHub env and OIDC

* Test on 3.11

Author: maxrjones

.github/workflows/main.yaml

@@ -22,7 +22,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.9', '3.10'] #TODO: add 3.11 once sparse/numba support it
+        python-version: ['3.9', '3.10', '3.11']
     timeout-minutes: 20
     defaults:
       run:

.github/workflows/pypi-release.yaml

@@ -0,0 +1,100 @@
+name: Build and Upload cmip6_dowscaling to PyPI
+on:
+  release:
+    types:
+      - published
+  # Runs for pull requests should be disabled other than for testing purposes
+  # pull_request:
+  #   branches:
+  #     - main
+
+permissions:
+  contents: read
+
+jobs:
+  build-artifacts:
+    runs-on: ubuntu-latest
+    if: github.repository == 'carbonplan/cmip6-downscaling'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/[email protected]
+        name: Install Python
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build twine
+          git clean -xdf
+          git restore -SW .
+
+      # This step is only necessary for testing purposes and for TestPyPI
+      - name: Fix up version string for TestPyPI
+        if: ${{ !startsWith(github.ref, 'refs/tags') }}
+        run: |
+          # Change setuptools-scm local_scheme to "no-local-version" so the
+          # local part of the version isn't included, making the version string
+          # compatible with PyPI.
+          sed --in-place "s/node-and-date/no-local-version/g" pyproject.toml
+
+      - name: Build tarball and wheels
+        run: |
+          python -m build
+      - name: Check built artifacts
+        run: |
+          python -m twine check --strict dist/*
+          pwd
+          if [ -f dist/cmip6_downscaling-0.0.0.tar.gz ]; then
+            echo "❌ INVALID VERSION NUMBER"
+            exit 1
+          else
+            echo "✅ Looks good"
+          fi
+      - uses: actions/upload-artifact@v4
+        with:
+          name: releases
+          path: dist
+
+  test-built-dist:
+    needs: build-artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/[email protected]
+        name: Install Python
+        with:
+          python-version: '3.11'
+      - uses: actions/download-artifact@v4
+        with:
+          name: releases
+          path: dist
+      - name: List contents of built dist
+        run: |
+          ls -ltrh
+          ls -ltrh dist
+      - name: Verify the built dist/wheel is valid
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install dist/cmip6_downscaling*.whl
+          python -c "import cmip6_downscaling; print(cmip6_downscaling.__version__)"
+      - name: Publish package to TestPyPI
+        uses: pypa/[email protected]
+        with:
+          password: ${{ secrets.TEST_PYPI_TOKEN }}
+          repository-url: https://test.pypi.org/legacy/
+          # verbose: true
+
+  upload-to-pypi:
+    needs: test-built-dist
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: releases
+          path: dist
+      - name: Publish package to PyPI
+        uses: pypa/[email protected]