use pypa/gh-action-pypi-publish (#1599)

Co-authored-by: David Hewitt <[email protected]>

Author: samuelcolvin

.github/workflows/ci.yml

@@ -662,6 +662,10 @@ jobs:
     needs: [test-builds-arch, test-builds-os, build-sdist, check]
     if: always() && startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
+    environment: release
+
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -685,11 +689,10 @@ jobs:
 
       - run: twine check --strict dist/*
 
-      - name: upload to pypi
-        run: twine upload dist/*
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.pypi_token }}
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@v1
+        with:
+          skip-existing: true
 
       - name: get wasm dist artifacts
         uses: actions/download-artifact@v4