Merge pull request #3 from wyleung/fix_publish

Fix publish strategy to leverage Trusted Publisher between GH and pypi

Author: wyleung

.github/workflows/python-publish.yml

@@ -18,6 +18,8 @@ permissions:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -28,11 +30,9 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install build
-      - name: Build package
-        run: python -m build
-      - name: Publish package
-        uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
+          pip install setuptools wheel build
+      - name: Build
+        run: |
+          python -m build
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1