Initial draft for Anderson Darling test constraint.

.github/.pull_request_template.md

@@ -1,5 +1,5 @@
 # CI
 
-<!-- 
+<!--
 Note: In order for the CI to test against the correct database backend, please label this pull request with the name of the backend you'd like to test against, e.g. "postgres" for running the postgres tests on each commit.
--->
+-->

.github/workflows/build_and_publish.yaml

@@ -3,9 +3,9 @@ on:
   pull_request:
   push:
     branches:
-      - 'main'
+      - "main"
     tags:
-      - 'v*'
+      - "v*"
   release:
     types:
       - published
@@ -17,30 +17,31 @@ jobs:
     strategy:
       fail-fast: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Set up pixi
-        uses: prefix-dev/setup-pixi@v0.8.1
+        uses: prefix-dev/setup-pixi@v0.9.3
       - name: Build
         # It seems as though flit publish expects a .pypirc file as compared to
         # only a token passed as an argument.
         # See https://flit.pypa.io/en/latest/cmdline.html#flit-publish
         run: |
           pixi run flit build
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           path: dist/*
 
   upload_pypi:
     name: Upload to PyPI
     needs: [build_artifacts]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
+    environment: pypi
     if: github.event_name == 'release' && github.event.action == 'published'
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           name: artifact
           path: dist
-      - uses: pypa/gh-action-pypi-publish@v1.9.0
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_TOKEN }}
+      - uses: pypa/gh-action-pypi-publish@v1.13.0