use trusted publishing for pypi

.github/workflows/pypi_upload.yml

@@ -4,7 +4,7 @@ on:
  release:
  types: [published]
  push:
- branches: [main]
+ branches: [main, pypi-trusted-publishing]
 
 permissions:
  contents: read
@@ -37,6 +37,7 @@ jobs:
  - name: Build a source tarball
  env:
  LIBCST_NO_LOCAL_SCHEME: 1
+ SETUPTOOLS_SCM_PRETEND_VERSION: 0.0.1
  run: >-
  hatch run python -m
  build
@@ -46,14 +47,10 @@ jobs:
  if: github.event_name == 'push'
  uses: pypa/gh-action-pypi-publish@release/v1
  with:
- user: __token__
- password: ${{ secrets.TEST_PYPI_API_TOKEN }}
  repository-url: https://test.pypi.org/legacy/
  packages-dir: ${{ steps.download.outputs.download-path }}
  - name: Publish distribution 📦 to PyPI
  if: github.event_name == 'release'
  uses: pypa/gh-action-pypi-publish@release/v1
  with:
- user: __token__
- password: ${{ secrets.PYPI_API_TOKEN }}
  packages-dir: ${{ steps.download.outputs.download-path }}