CI: update the PyPI publishing workflow to use OpenID connection

.github/workflows/publish-pypi.yml

@@ -11,23 +11,25 @@ jobs:
   deploy:
 
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
 
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python
-      uses: actions/setup-python@v2
-      with:
-        python-version: '3.x'
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install wheel twine setuptools
-    - name: Build and publish
-      env:
-        TWINE_USERNAME: __token__
-        # The PYPI_PASSWORD must be a pypi token with the "pypi-" prefix with sufficient permissions to upload this package
-        # https://pypi.org/help/#apitoken
-        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-      run: |
-        python setup.py sdist bdist_wheel
-        twine upload dist/*
+      - uses: actions/checkout@v3
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.x'
+
+      - name: Build package
+        run: |
+          set -vxeuo pipefail
+          python -m pip install --upgrade pip
+          pip install wheel setuptools
+          python setup.py sdist bdist_wheel
+
+      - name: Publish wheels to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: ./dist/