ci: simplify pypi publish workflow

Author: bardonadam

.github/workflows/publish.yml

@@ -14,8 +14,6 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     environment: release
-    env:
-      PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
@@ -24,36 +22,25 @@ jobs:
           python-version: "3.11"
 
       - name: Verify tag matches package version
+        if: startsWith(github.ref, 'refs/tags/v')
         run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
           PACKAGE_VERSION="$(python - <<'PY'
 import tomllib
-with open("pyproject.toml", "rb") as f:
+with open('pyproject.toml', 'rb') as f:
     data = tomllib.load(f)
-print(data["project"]["version"])
+print(data['project']['version'])
 PY
 )"
-          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
-            TAG_VERSION="${GITHUB_REF_NAME#v}"
-            if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
-              echo "Tag version ($TAG_VERSION) does not match package version ($PACKAGE_VERSION)."
-              exit 1
-            fi
-          else
-            echo "Non-tag ref '${GITHUB_REF_NAME}', publishing package version ${PACKAGE_VERSION}."
+          if [ "$TAG_VERSION" != "$PACKAGE_VERSION" ]; then
+            echo "Tag version ($TAG_VERSION) does not match package version ($PACKAGE_VERSION)."
+            exit 1
           fi
 
       - name: Build distributions
         run: |
           python -m pip install -U pip build
           python -m build
 
-      - name: Publish to PyPI (API token)
-        if: ${{ env.PYPI_API_TOKEN != '' }}
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ env.PYPI_API_TOKEN }}
-
-      - name: Publish to PyPI (trusted publisher)
-        if: ${{ env.PYPI_API_TOKEN == '' }}
+      - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1