update pypi publishing to trusted publishing

Author: FynnBe

.github/workflows/build.yaml

@@ -190,6 +190,11 @@ jobs:
     name: Build and publish to PyPI
     needs: [deploy, conda-build]
     runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/project/bioimageio.spec/
+    permissions:
+      id-token: write # required for pypi publish action
     steps:
       - name: Check out the repository
         uses: actions/checkout@v4
@@ -233,10 +238,8 @@ jobs:
 
       - name: Publish package on PyPI
         if: github.ref == 'refs/heads/main' && steps.tag-version.outputs.new_tag
-        uses: pypa/gh-action-pypi-publish@release/v1.12
+        uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: '${{ secrets.PYPI_TOKEN }}'
           packages-dir: dist/
 
       - name: Publish the release notes