ci: use trusted publisher deployment (#306)

New PyPI feature.

Signed-off-by: Henry Schreiner <[email protected]>

Author: henryiii

.github/workflows/cd.yml

@@ -12,6 +12,9 @@ env:
 jobs:
   deploy:
     runs-on: ubuntu-22.04
+    environment: pypi
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v3
         with:
@@ -26,5 +29,3 @@ jobs:
 
       - uses: pypa/[email protected]
         if: github.event_name == 'release' && github.event.action == 'published'
-        with:
-          password: ${{ secrets.pypi_password }}