trusted publish (#478)

Author: andrzejnovak

Diff for: .github/workflows/cd.yml

@@ -26,18 +26,17 @@ jobs:
       run: pipx run twine check dist/*
 
 
-  publish:
-    needs: [dist]
-    runs-on: ubuntu-latest
-    if: github.event_name == 'release' && github.event.action == 'published'
-
-    steps:
-    - uses: actions/download-artifact@v3
+publish:
+  needs: [dist]
+  environment: release
+  permissions:
+    id-token: write
+  runs-on: ubuntu-latest
+  if: github.event_name == 'release' && github.event.action == 'published'
+  steps:
+    - uses: actions/download-artifact@v4
       with:
-        name: artifact
+        name: Packages
         path: dist
 
-    - uses: pypa/[email protected]
-      with:
-        password: ${{ secrets.pypi_password }}
-        print-hash: true
+    - uses: pypa/gh-action-pypi-publish@release/v1