Flb/trusted publisher on pypi (#791)

This pull request modifies the continuous deployment workflow to
separate the build and publish steps,
and using trusted publisher on PyPI.

This repository has been added on PyPI as trusted publisher using the
workflow cd_pyblish.yaml within the environement 'release'.

The 'release' environment has been added to EMMOntoPy repo.



## Type of change
<!-- Put an `x` in the box that applies. -->
- [ ] Bug fix.
- [ ] New feature.
- [ ] Documentation update.
- [ ] Test update.

## Checklist
<!-- Put an `x` in the boxes that apply. You can also fill these out
after creating the PR. -->

This checklist can be used as a help for the reviewer.

- [ ] Is the code easy to read and understand?
- [ ] Are comments for humans to read, not computers to disregard?
- [ ] Does a new feature has an accompanying new test (in the CI or unit
testing schemes)?
- [ ] Has the documentation been updated as necessary?
- [ ] Does this close the issue?
- [ ] Is the change limited to the issue?
- [ ] Are errors handled for all outcomes?
- [ ] Does the new feature provide new restrictions on dependencies, and
if so is this documented?

## Comments
<!-- Additional comments here, including clarifications on checklist if
applicable. -->

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: TEAM 4.0[bot] <[email protected]>
Co-authored-by: Jesper Friis <[email protected]>

.github/workflows/cd_publish.yml

@@ -5,7 +5,7 @@ on:
     types: [published]
 
 jobs:
-  publish:
+  build:
     name: External
     uses: SINTEF/ci-cd/.github/workflows/[email protected]
     if: github.repository == 'emmo-repo/EMMOntoPy' && startsWith(github.ref, 'refs/tags/v')
@@ -21,8 +21,11 @@ jobs:
       # ontopy/__init__.py
       package_dirs: ontopy
       install_extras: "[dev]"
-      build_cmd: "python -m build"
-      publish_on_pypi: true
+      build_libs: build
+      build_cmd: "python -m build -o dists"
+      build_dir: dists
+      publish_on_pypi: false
+      upload_distribution: true
 
       # Update documentation
       update_docs: true
@@ -32,3 +35,26 @@ jobs:
 
     secrets:
       PAT: ${{ secrets.RELEASE_PAT }}
+
+  publish:
+    name: Publish on PyPI
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/project/EMMOntoPy
+    permissions:
+      id-token: write
+
+    steps:
+      - name: Download distribution
+        uses: actions/download-artifact@v4
+        with:
+          name: dist  # The artifact will always be called 'dist'
+          path: my-dists
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          # The path to the distribution to upload
+          package-dir: my-dists