Publish packages to PyPi with trusted publishers

Signed-off-by: Pedro Algarvio <palgarvio@vmware.com>

.github/workflows/release.yml

@@ -5,26 +5,33 @@ on:
     types: [created]
 
 jobs:
-  Publish:
+  publish:
+    name: Publish Release
+    environment: release
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
     steps:
     - uses: actions/checkout@v3
       with:
         fetch-depth: 0
+
     - name: Set up Python
       uses: actions/setup-python@v4
       with:
         python-version: 3.9
+
     - name: Install Nox
       run: |
         python -m pip install nox
+
     - name: Build a binary wheel and a source tarball
       run: |
         nox -e build
 
     - name: Publish distribution 📦 to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: __token__
-        password: ${{ secrets.PYPI_TOKEN }}
-        print_hash: true
+        print-hash: true
+        skip-existing: true
+        verify-metadata: true

.github/workflows/testing.yml

@@ -435,6 +435,9 @@ jobs:
 
   Build:
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
     needs:
       - Docs
       - PyLint
@@ -463,7 +466,7 @@ jobs:
       if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: __token__
-        password: ${{ secrets.TEST_PYPI_TOKEN }}
-        repository_url: https://test.pypi.org/legacy/
-        print_hash: true
+        repository-url: https://test.pypi.org/legacy/
+        print-hash: true
+        skip-existing: true
+        verify-metadata: true

changelog/151.trivial.rst

@@ -0,0 +1 @@
+Publish packages to PyPi with trusted publishers