Publish with a Trusted Publisher

Author: borntyping

.github/workflows/ci.yml

@@ -52,7 +52,11 @@ jobs:
         run: "python -m pytest"
   publish:
     name: "📦 Publish Python distributions"
+    if: "startsWith(github.ref, 'refs/tags')"
     runs-on: "ubuntu-latest"
+    environment: "publish"
+    permissions:
+      id-token: write
     strategy:
       matrix:
         python-version:
@@ -69,8 +73,5 @@ jobs:
         run: "python -m pip install wheel --user"
       - name: "🐍 Build a binary wheel and a source tarball"
         run: "python setup.py sdist bdist_wheel"
-      - name: "📦 Publish distribution to PyPI"
+      - name: "📦 Publish package distributions to PyPI"
         uses: "pypa/gh-action-pypi-publish@release/v1"
-        if: "startsWith(github.ref, 'refs/tags')"
-        with:
-          password: "${{ secrets.pypi_password }}"