Making release workflow use OIDC correctly

Author: delfick

.github/workflows/release.yml

@@ -3,14 +3,16 @@ on:
 
 name: Release Packages
 
-permissions:
-  contents: write
-
 jobs:
   build:
     name: Create the package
     runs-on: ubuntu-latest
     environment: github_release
+    permissions:
+      # for trusted publishing
+      id-token: write
+      # for creating the release
+      contents: write
     steps:
       - uses: actions/checkout@v4
 
@@ -40,8 +42,5 @@ jobs:
           prerelease: false
           files: "dist/*"
 
-      - uses: pypa/[email protected]
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN_CORE }}
-          packages_dir: dist
+      - name: publish
+        uses: pypa/gh-action-pypi-publish@release/v1