update release gha to use trusted publisher

Author: hobu

.github/workflows/release.yml

@@ -10,37 +10,39 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  pypi-publish:
-    name: Upload release to PyPI
-    runs-on: ubuntu-latest
-    environment:
-      name: release
-      url: https://pypi.org/p/pdal-plugins
-    permissions:
-      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
-    strategy:
-      fail-fast: true
 
+  build_sdist:
+    name: Build source distribution
+    runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4
 
-    - name: Setup micromamba
-      uses: conda-incubator/setup-miniconda@v3
+    - uses: actions/setup-python@v5
+      name: Install Python
+      with:
+        python-version: '3.11'
+
+    - name: Build sdist
+      run: pipx run build --sdist
+
+    - uses: actions/upload-artifact@v4
       with:
-        miniforge-variant: Miniforge3
-        miniforge-version: latest
-        use-mamba: true
-        python-version: ${{ matrix.python-version }}
-        auto-update-conda: true
-        environment-file: .github/environment.yml
-
-    - name: Install dependencies
-      shell: bash -l {0}
-      run: |
-        python -m pip install build pipx twine
-        pipx run build --sdist
-
-    - name: Publish package distributions to PyPI
-      if: github.event_name == 'release' && github.event.action == 'published'
-      uses: pypa/gh-action-pypi-publish@release/v1
+        name: cibw-sdist
+        path: dist/*.tar.gz
+
+  upload_pypi:
+    needs: [build_wheels, build_sdist]
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    if: github.event_name == 'release' && github.event.action == 'published'
+    steps:
+    - uses: actions/download-artifact@v4
+      with:
+        pattern: cibw-*
+        path: dist
+        merge-multiple: true
+
+    - uses: pypa/gh-action-pypi-publish@release/v1