fix version check and release in CI (#310)

Author: samuelcolvin

.github/workflows/ci.yml

@@ -201,7 +201,7 @@ jobs:
 
       - name: check GITHUB_REF matches package version
         uses: samuelcolvin/check-python-version@v4.1
-        if: "startsWith(github.ref, 'refs/tags/')"
+        if: ${{ startsWith(github.ref, 'refs/tags/') && matrix.os == 'ubuntu' }}
         with:
           version_file_path: Cargo.toml
 
@@ -286,17 +286,14 @@ jobs:
     needs: [build, check, docs]
     if: "success() && startsWith(github.ref, 'refs/tags/')"
     runs-on: ubuntu-latest
+    environment: release
+
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
 
-      - name: set up python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.10'
-
-      - run: pip install twine
-
       - name: get dist artifacts
         uses: actions/download-artifact@v4
         with:
@@ -310,13 +307,10 @@ jobs:
           name: docs
           path: site
 
-      - run: twine check dist/*
-
-      - name: upload to pypi
-        run: twine upload dist/*
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.pypi_token }}
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true
 
       - name: publish docs
         uses: JamesIves/github-pages-deploy-action@v4.2.5