chore: use trusted publisher to publish pypi package.

.github/workflows/release.yml

@@ -61,6 +61,11 @@ jobs:
   publish-pypi-package:
     runs-on: [ubuntu-latest]
     needs: release-please
+    environment:
+      name: pypi
+      url: https://pypi.org/p/cellxgene-ontology-guide
+    permissions:
+      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
     if: contains(needs.release-please.outputs.paths_released, 'api/python')
     steps:
       - name: Checkout main branch
@@ -72,10 +77,10 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: 3.11
-      - name: build and publish
-        # TODO change to make publish
+      - name: build
         run: |
-          make test/publish -C api/python
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.TESTPYPI_TOKEN_BENTO007 }}
+          make build -C api/python
+      - name: Publish distribution 📦 to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: api/python/dist

api/python/Makefile

@@ -20,10 +20,11 @@ build: package-data
 	pip install build twine
 	python -m build
 
-test/publish: build
+release/testpypi: build
 	python -m twine upload --repository testpypi dist/*
 
-publish: build
+release/pypi: build
+	# Manually release in case CI/CD pipeline is not working in ./.github/workflows/release.yml
 	python -m twine upload dist/*
 
 unit-tests: