pypi publish with trusted publisher

Author: jwallnoefer

.github/workflows/ci.yaml

@@ -24,8 +24,8 @@ jobs:
           python-version: '3.12'
       - uses: pre-commit/action@v3.0.1
 
-  test_pipenv:
-    name: Run tests in development environment with pipenv
+  test_devenv:
+    name: Run tests in development environment
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -110,6 +110,8 @@ jobs:
     if: github.event.ref == 'refs/heads/dev'
     runs-on: ubuntu-latest
     needs: [dist_check]
+    permissions:
+      id-token: write
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -118,30 +120,25 @@ jobs:
       - name: Publish distribution to Test PyPI
         uses: pypa/gh-action-pypi-publish@v1.13.0
         with:
-          user: __token__
-          password: ${{ secrets.test_pypi_token }}
-          repository_url: https://test.pypi.org/legacy/
-          skip_existing: true
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true
 
 
   dist_upload_pypi:
     if: startsWith(github.event.ref, 'refs/tags')
     runs-on: ubuntu-latest
     needs: [dist_check]
+    permissions:
+      id-token: write
     steps:
       - uses: actions/download-artifact@v4
         with:
           name: dist
           path: dist
       - name: Publish package to PyPI
         uses: pypa/gh-action-pypi-publish@v1.13.0
-        with:
-          user: __token__
-          password: ${{ secrets.pypi_token }}
       - name: Publish distribution to Test PyPI
         uses: pypa/gh-action-pypi-publish@v1.13.0
         with:
-          user: __token__
-          password: ${{ secrets.test_pypi_token }}
-          repository_url: https://test.pypi.org/legacy/
-          skip_existing: true
+          repository-url: https://test.pypi.org/legacy/
+          skip-existing: true