Update CI to test with matrix and use trusted publishing

.github/workflows/test_build.yml

@@ -0,0 +1,74 @@
+name: Lint & build
+
+on: [push]
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        py_version: ["3.8", "3.9", "3.10", "3.11"]
+        include:
+          - os: windows-latest
+            py_version: "3.8"
+          - os: windows-latest
+            py_version: "3.11"
+          - os: macos-latest
+            py_version: "3.8"
+          - os: macos-latest
+            py_version: "3.11"
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: ${{ matrix.py_version }}
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install .[dev,cli]
+        python -m pip install opencv-python-headless>=4.8
+    - name: Lint
+      run: |
+        poe lint
+    - name: Typecheck
+      run: |
+        poe type
+    - name: Run tests
+      run: |
+        poe test
+
+  build:
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 0
+    - name: Set up Python 3.8
+      uses: actions/setup-python@v4
+      with:
+        python-version: "3.8"
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip build poethepoet
+        # Install package to generate version info
+        python -m pip install --no-deps .
+    - name: Build package
+      run: |
+        poe build
+    - name: Save built package
+      uses: actions/upload-artifact@v3
+      with:
+        name: package
+        path: |
+          dist
+    - name: Publish to PyPi
+      if: ${{ github.ref_type	== 'tag' }}
+      uses: pypa/gh-action-pypi-publish@release/v1