Swap to trusted publishing (#136)

.github/workflows/publish-to-test-pypi.yml → .github/workflows/publish-to-pypi.yml

@@ -14,6 +14,10 @@ on:
     branches:
     - '**'
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   build-n-publish:
     name: Build and publish Python distributions to PyPI
@@ -23,27 +27,33 @@ jobs:
     - uses: actions/checkout@v3
       with:
         fetch-depth: 0
+
     - run: |
         git fetch origin +refs/tags/*:refs/tags/*
+
     - name: Set up Python 3.8
       uses: actions/setup-python@v4
       with:
         python-version: 3.8
+
     - name: Install pep517
       run: >-
         python -m
         pip install
         pep517
         --user
+
     - name: Build a binary wheel and a source tarball
       run: >-
         python -m
         pep517.build
         --binary
         --out-dir dist/
         .
+
     - name: Publish distribution to PyPI
       if: startsWith(github.event.ref, 'refs/tags')
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        password: ${{ secrets.pypi_password }}
+        packages-dir: dist/
+        skip-existing: true