publish via trusted publishers

Author: minrk

.github/workflows/release.yml

@@ -20,12 +20,13 @@ concurrency:
 
 jobs:
   build-release:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
-          python-version: 3.8
+          python-version: 3.11
+          cache: pip
 
       - name: install build package
         run: |
@@ -41,7 +42,7 @@ jobs:
       - name: verify wheel
         run: |
           cd dist
-          pip install ./*.whl jupyterlab==3.*
+          pip install ./*.whl jupyterlab==4.*
           ipcluster --help-all
           ipcontroller --help-all
           ipengine --help-all
@@ -55,11 +56,18 @@ jobs:
           path: "dist/*"
           if-no-files-found: error
 
-      - name: Publish to PyPI
-        if: startsWith(github.ref, 'refs/tags/')
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        run: |
-          pip install twine
-          twine upload --skip-existing dist/*
+  upload-pypi:
+    permissions:
+      id-token: write
+    environment: release
+    runs-on: ubuntu-22.04
+    if: startsWith(github.ref, 'refs/tags/')
+    needs:
+      - build-release
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+      - name: Publish wheels to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1