Use uv in first-party "publish" CI workflow

- Drop use of iiasa/actions

.github/workflows/publish.yaml

@@ -1,11 +1,15 @@
 name: Build package / publish
 
 on:
-  pull_request:  # Check that package can be built even on PRs
+  # On PR commits, check build completes w/o error.
+  pull_request:
     branches: [ main ]
   push:
     branches: [ main ]
+    # Publish on any push of a new tag, including
+    # 'v*rc*' pushed to a PR branch.
     tags: [ "v*" ]
+  # Publish on new releases.
   release:
     types: [ published ]
 
@@ -15,7 +19,31 @@ concurrency:
 
 jobs:
   publish:
-    uses: iiasa/actions/.github/workflows/publish.yaml@main
-    secrets:
-      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
-      TESTPYPI_TOKEN: ${{ secrets.TESTPYPI_TOKEN }}
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+      # On 'pull_request' and some 'push' events,
+      # setuptools-scm will produce version '0.1.dev1'.
+      # To confirm that setuptools-scm generates the
+      # correct version string, uncomment these lines
+      # and adjust fetch-depth.
+      # with:
+      #   fetch-depth: 10
+      #   fetch-tags: true
+
+    - uses: astral-sh/setup-uv@v5
+      with:
+        cache-dependency-glob: "**/pyproject.toml"
+        python-version: "3.13"
+
+    - name: Build
+      run: uv build
+
+    - name: Publish
+      if: >-
+        github.event_name == 'release' || (
+          github.event_name == 'push'
+          && startsWith(github.ref, 'refs/tags')
+        )
+      run: uv publish --trusted-publishing=always