Fix deployment (#649)

Author: asvetlov

.github/workflows/ci.yml

@@ -144,9 +144,13 @@ jobs:
       with:
         python-version: 3.13
     - name: Install dependencies
-      run: python -m pip install -U pip wheel
+      run: python -m pip install -U pip wheel build
     - name: Make dists
-      run: python setup.py sdist bdist_wheel
+      run: python -m build
+
+    - name: Login
+      run: |
+        echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
     - name: Release
       uses: aio-libs/create-release@v1.6.6
       with:
@@ -158,3 +162,24 @@ jobs:
         version_file: aiosignal/__init__.py
         fix_issue_regex: "\n?\\s*`#(\\d+) <https://github.com/aio-libs/aiosignal/issues/\\1>`_"
         fix_issue_repl: ' (#\1)'
+
+    - name: >-
+        Publish 🐍📦 to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+
+    - name: Sign the dists with Sigstore
+      uses: sigstore/gh-action-sigstore-python@v3.0.0
+      with:
+        inputs: >-
+          ./dist/*.tar.gz
+          ./dist/*.whl
+
+    - name: Upload artifact signatures to GitHub Release
+      # Confusingly, this action also supports updating releases, not
+      # just creating them. This is what we want here, since we've manually
+      # created the release above.
+      uses: softprops/action-gh-release@v2
+      with:
+        # dist/ contains the built packages, which smoketest-artifacts/
+        # contains the signatures and certificates.
+        files: dist/**