Tune release process

Author: asvetlov

.github/workflows/ci.yaml

@@ -96,6 +96,13 @@ jobs:
     runs-on: ubuntu-latest
     needs: [check]
     if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
+    permissions:
+      contents: write  # IMPORTANT: mandatory for making GitHub Releases
+      id-token: write  # IMPORTANT: mandatory for trusted publishing & sigstore
+    environment:
+      name: pypi
+      url: >-
+        https://pypi.org/project/${{ env.PROJECT_NAME }}/${{ github.ref_name }}
     steps:
     - name: Checkout
       uses: actions/checkout@v4