Use trusted publishing for package uploads

[krassowski]

Use trusted publishing for package uploads

[Copilot]

Pull Request Overview

This PR aims to improve package upload security by using trusted publishing.

• Upgrades the Python version from 3.8 to 3.9 in the workflow.
• Splits the publishing flow into a "build" job that uploads artifacts and a "pypi-publish" job that downloads the artifacts and publishes the package to PyPI using the trusted publishing action.

[Copilot]

Pull Request Overview

This PR implements trusted publishing for package uploads by separating the build and publish processes in the GitHub Actions workflow.

• Upgraded Python version from 3.8 to 3.9.
• Split the workflow into a build job that uploads an artifact and a pypi-publish job that downloads the artifact and publishes to PyPI.

Comments suppressed due to low confidence (1)

.github/workflows/publish.yml:25

• [nitpick] The artifact name contains spaces and uses a non-standard format. Consider renaming it to a more conventional format such as "docstring-to-markdown-dist-${{ github.run_number }}" to improve clarity and consistency.

name: docstring-to-markdown dist ${{ github.run_number }}