Use my composite actions

To avoid code duplication and make management easier.

.github/workflows/ci.yml

@@ -25,29 +25,24 @@ jobs:
           - {name: 'package', python: '3.13', tox: package}
 
     steps:
-      - uses: actions/checkout@v3
-
-      - uses: actions/setup-python@v3
+      - uses: pgjones/actions/tox@v1
         with:
-          python-version: ${{ matrix.python }}
+          environment: ${{ matrix.tox }}
 
-      - name: update pip
-        run: |
-          pip install -U wheel
-          pip install -U setuptools
-          python -m pip install -U pip
-
-      - run: pip install tox
+  zizmor:
+    name: Zizmor
+    runs-on: ubuntu-latest
 
-      - run: tox -e ${{ matrix.tox }}
+    steps:
+      - uses: pgjones/actions/zizmor@v1
 
   compliance:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v3
+      - uses: actions/setup-python@v5
         with:
           python-version: '3.13'
 

.github/workflows/publish.yml

@@ -7,19 +7,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-
-      - uses: actions/setup-python@v3
-        with:
-          python-version: 3.13
-
-      - run: |
-          pip install pdm
-          pdm build
-
-      - uses: actions/upload-artifact@v3
-        with:
-          path: ./dist
+      - uses: pgjones/actions/build@v1
 
   pypi-publish:
     needs: ['build']
@@ -31,9 +19,9 @@ jobs:
       # IMPORTANT: this permission is mandatory for trusted publishing
       id-token: write
     steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
 
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          packages_dir: artifact/
+          packages-dir: artifact/