Switch to Trusted Publishers with a GitHub Environment

Author: sethmlarson

.github/workflows/ci.yml

@@ -109,6 +109,10 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     needs: [lint, test, package-sdist, package-wheel]
+    environment: publish
+    permissions:
+      # Required by Trusted Publishing
+      id-token: write
     steps:
       - uses: actions/checkout@v5
       - uses: actions/download-artifact@v6
@@ -130,6 +134,3 @@ jobs:
       - name: Publish to PyPI
         if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/')
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_TOKEN }}