Add trusted-publish (#2559)

.github/workflows/check.yml

@@ -1,6 +1,7 @@
 name: check
 on:
   push:
+    tags-ignore: ["**"]
   pull_request:
   schedule:
     - cron: "0 8 * * *"

.github/workflows/release.yml

@@ -0,0 +1,27 @@
+name: Release to PyPI
+on:
+  push:
+    tags: ["*"]
+
+jobs:
+  release:
+    runs-on: ubuntu-22.04
+    environment:
+      name: release
+      url: https://pypi.org/p/virtualenv
+    permissions:
+      id-token: write
+    steps:
+      - name: Setup python to build package
+        uses: actions/setup-python@v4
+        with:
+          python-version: "3.11"
+      - name: Install build
+        run: python -m pip install build
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Build package
+        run: pyproject-build -s -w . -o dist
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@v1.8.5