ci: Migrate release workflow to Trusted Publishing #1281

	name: CI

	on:
	push:
	branches:
	- "main"
	pull_request: {}

	defaults:
	run:
	shell: bash

	jobs:
	test:
	name: Test Python ${{ matrix.python }}
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	python: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
	steps:
	- uses: actions/checkout@v3
	- uses: astral-sh/setup-uv@v7
	with:
	python-version: ${{ matrix.python }}
	enable-cache: true

	- name: Install dependencies
	run: uv sync --locked --dev

	- name: Check formatting
	run: uv run ruff format --check .

	- name: Lint
	run: uv run ruff check --extend-exclude .devbox

	- name: Type Check
	run: uv run mypy

	- name: Test
	run: uv run pytest

	smoke-test:
	name: Smoke test (Python ${{ matrix.python }})
	if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'version-bump')
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	python: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
	steps:
	- uses: actions/checkout@v3
	- uses: astral-sh/setup-uv@v7
	with:
	python-version: ${{ matrix.python }}

	- name: Build
	run: uv build

	- name: Smoke test (wheel)
	run: uv run --isolated --no-project --with dist/*.whl tests/smoke_test.py

	- name: Smoke test (sdist)
	run: uv run --isolated --no-project --with dist/*.tar.gz tests/smoke_test.py

Provide feedback