Trusted publisher (#319)

* test publishing

* removed too many stuff

* temporarily limiting the number of wheels

* add pypi and revert temporary changes

* changelog

* revert previous changes

.github/workflows/build-wheels.yml

@@ -69,6 +69,11 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'published'
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
+    environment: 
+      name: release
+      url: https://test.pypi.org/p/tabmat
+    permissions:
+      id-token: write
     steps:
       - uses: actions/download-artifact@v3
         with:
@@ -77,21 +82,21 @@ jobs:
 
       - uses: pypa/gh-action-pypi-publish@v1.8.10
         with:
-          user: __token__
-          password: ${{ secrets.GH_TESTPYPI_UPLOAD }}
           repository-url: https://test.pypi.org/legacy/
 
   upload_pypi:
     if: github.event_name == 'release' && github.event.action == 'published'
     needs: [build_wheels, build_sdist, upload_testpypi]
     runs-on: ubuntu-latest
+    environment: 
+      name: release
+      url: https://pypi.org/p/tabmat
+    permissions:
+      id-token: write
     steps:
       - uses: actions/download-artifact@v3
         with:
           name: artifact
           path: dist
 
       - uses: pypa/gh-action-pypi-publish@v1.8.10
-        with:
-          user: __token__
-          password: ${{ secrets.GH_PYPI_UPLOAD }}

CHANGELOG.rst

@@ -10,6 +10,9 @@ Changelog
 Unreleased
 ----------
 
+**Other changes:**
+
+- Pypi release is now done using trusted publisher.
 
 3.1.12 - 2023-10-16
 -------------------