use trusted publishing

Author: akaszynski

.github/workflows/build-and-deploy.yml

@@ -55,29 +55,29 @@ jobs:
           name: tetgen-sdist
           path: dist/*.tar.gz
 
-  upload_pypi:
+
+  release:
+    name: Release
+    if: github.event_name == 'push' && contains(github.ref, 'refs/tags')
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
-    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    environment:
+      name: pypi
+      url: https://pypi.org/p/tetgen
+    permissions:
+      id-token: write  # this permission is mandatory for trusted publishing
     steps:
       - uses: actions/download-artifact@v4
-        with:
-          path: artifacts/
-
-      - name: Move wheel files to dist/
+      - name: Flatten directory structure
         run: |
-          mkdir -p dist
-          find artifacts -name '*.whl' -exec mv {} dist/ \;
-
-      # upload to PyPI
-      - uses: pypa/gh-action-pypi-publish@v1.8.11
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_TOKEN }}
-
-      - name: Release
+          mkdir -p dist/
+          find . -name '*.whl' -exec mv {} dist/ \;
+          find . -name '*.tar.gz' -exec mv {} dist/ \;
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: Create GitHub Release
         uses: softprops/action-gh-release@v1
         with:
           generate_release_notes: true
           files: |
-            ./dist/*.whl
+            ./**/*.whl