From d777daa7a39750867243c05ebec22fdeaaa40878 Mon Sep 17 00:00:00 2001
From: 0x2b3bfa0 <0x2b3bfa0@users.noreply.github.com>
Date: Tue, 12 Sep 2023 21:05:12 +0000
Subject: [PATCH] update template

---
 .cruft.json                            | 2 +-
 .github/workflows/release.yaml         | 6 ++++--
 .github/workflows/update-template.yaml | 5 ++++-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/.cruft.json b/.cruft.json
index c5c2743..fd3bff2 100644
--- a/.cruft.json
+++ b/.cruft.json
@@ -1,6 +1,6 @@
 {
   "template": "https://github.com/iterative/cookiecutter-dvc-plugin/",
-  "commit": "d0c923cc6da8207f5fa4f91109e48f5f9f5a17c9",
+  "commit": "91159828cdce86290b97bf4985732651805523c4",
   "checkout": null,
   "context": {
     "cookiecutter": {
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 5d5457c..e7589f6 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -9,6 +9,10 @@ permissions:
 
 jobs:
   pip:
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-20.04
     steps:
     - uses: actions/checkout@v3
@@ -27,5 +31,3 @@ jobs:
         twine check dist/*
     - name: Publish packages to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        password: ${{ secrets.PYPI_TOKEN }}
diff --git a/.github/workflows/update-template.yaml b/.github/workflows/update-template.yaml
index d4963aa..b238a4f 100644
--- a/.github/workflows/update-template.yaml
+++ b/.github/workflows/update-template.yaml
@@ -7,6 +7,9 @@ on:
 
 jobs:
   update:
+    permissions:
+      contents: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3
@@ -23,4 +26,4 @@ jobs:
       with:
         commit-message: update template
         title: update template
-        token: ${{ secrets.WORKFLOW_TOKEN }}
+        token: ${{ github.token }}