Do releases with `tox`

With the following GitHub Actions one can fully automate the workflow of releasing a package:

• https://github.com/hynek/build-and-inspect-python-package
• https://github.com/pypa/gh-action-pypi-publish

The first one generates the sdist and wheel archives, with build, while the second one publishes, with twine, the archives to PyPI 🎉

For the second one we should/must use trusted publishing feature of PyPI, to ensure credentials are not leaked.

For a core plone package we would be missing a pre and a post action:

• (pre): update the change log with towncrier
• (post): update versions.cfg and checkouts.cfg from buildout.coredev (or its mxdev counterparts whenever the switch happens 😄 )

Probably the pre part could be actually what triggers the release workflow? 🤔

Are we missing anything? 🤔

PyPI trusted publishers approach recommends using a specific GitHub workflow to drive the releases, which is highly recommended to be only triggered by maintainers/release managers, further increasing the security of a PyPI release 🔒

Compare the linked GitHub Actions with the repository's existing release workflow and the versions.cfg/checkouts.cfg files used by buildout.coredev. Identify how towncrier, package publishing, and post-release updates should be coordinated, including maintainer-only trusted publishing. Done means the release sequence and its required pre- and post-actions are agreed and documented.