ci: publish release to testpypi from github actions

.github/workflows/python-package.yml

@@ -10,7 +10,7 @@ on:
     branches: [ master ]
 
 jobs:
-  build:
+  tests:
 
     runs-on: ubuntu-latest
     strategy:
@@ -23,14 +23,17 @@ jobs:
       uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
+
     - name: Install build dependencies for requests in python 3.9
       # it's not clear why this is needed only for this version of python
       run: sudo apt-get install libxml2-dev libxslt-dev
+
     - name: Install Poetry
       uses: snok/install-poetry@v1
       with:
         # Version of Poetry to use
-        version: 1.2.2
+        version: 1.4.1
+
     - name: Install dependencies
       run: |
         poetry install
@@ -50,3 +53,38 @@ jobs:
     - name: Generate coverage report
       run: |
         poetry run coverage report
+
+  build-and-publish:
+    runs-on: ubuntu-latest
+    needs: tests
+
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up Python 3.11
+      uses: actions/setup-python@v4
+      with:
+        python-version: "3.11"
+
+    - name: Install Poetry
+      uses: snok/install-poetry@v1
+      with:
+        # Version of Poetry to use
+        version: 1.4.1
+
+    - name: Build distribution tarball and wheel
+      # TODO: restrict this to master branch only
+      run: |
+        poetry build
+
+    - name: Publish distribution 📦 to Test PyPI
+      # publish to testpypi on all commit just for testing this PR
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        password: ${{ secrets.TEST_PYPI_API_TOKEN }}
+        repository-url: https://test.pypi.org/legacy/
+
+    - name: Publish distribution 📦 to PyPI
+      if: startsWith(github.ref, 'refs/tags')
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        password: ${{ secrets.PYPI_API_TOKEN }}

docs/index.md

@@ -164,12 +164,12 @@ $ pytest
 
 `slowapi` tries to follow [semantic versioning](https://semver.org/).
 
-To release a new version:
-
-- Update CHANGELOG.md
-- Bump the version number in `pyproject.toml`
-- `poetry build`
-- `poetry publish`
+Releases are published directly from CI (github actions). To create a new release:
+- Update `CHANGELOG.md` and the version in `pyproject.toml`,
+- Commit those changes to a new PR,
+- Get the PR reviewed and merged,
+- Tag the merge commit with the same version number prefixed with `v`, eg. `v0.1.6`,
+- Push the tag to trigger the release.
 
 # Credits