Use pypa/gh-actions-pypi-publish for trusted publishing

.github/workflows/build.yml

@@ -372,29 +372,25 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
 
-    steps:
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.x'
+    environment:
+      name: pypi
+    permissions:
+      id-token: write
 
+    steps:
       - name: Fetch built distributions
         uses: actions/download-artifact@v4
         with:
-          path: dist
+          path: download
 
       - name: Merge artifacts to single folder
         run: |
-          mv dist/dist-*/*.whl dist/
-          mv dist/dist-linux-manylinux2014_x86_64/*.tar.gz dist/
-
-      - name: Install twine
-        run: pip install twine
+          mkdir dist
+          mv download/dist-*/*.whl dist/
+          mv download/dist-linux-manylinux2014_x86_64/*.tar.gz dist/
 
       - name: Publish PyPI package
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
-        run: twine upload dist/*.whl dist/*.tar.gz
+        uses: pypa/gh-action-pypi-publish@release/v1
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2