Switch the Publish Release workflow to use OpenID Connect (#6012)

.github/workflows/publish_release.yml

@@ -53,28 +53,53 @@ jobs:
               echo 'Continuing...'
           fi
 
-  release_to_pypi:
+  build:
-    needs: release_information
+    name: Build package
-    environment: Release
-    name: Release to PyPI
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
           python-version: '3.8'
+
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install build twine
+          python -m pip install --upgrade build twine
-      - name: Build and publish
+
-        env:
+      - name: Build
-          TWINE_USERNAME: __token__
+        run: python -m build
-          TWINE_PASSWORD: ${{ secrets.pypi_token }}
+      - name: Check built distributions
-        run: |
+        run: python -m twine check dist/*
-          python -m build
+
-          twine upload dist/*
+      - name: Upload packaged distributions
+        uses: actions/upload-artifact@v3
+        with:
+          path: ./dist
+
+  release_to_pypi:
+    needs:
+      - release_information
+      - build
+    environment: Release
+    name: Release to PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - name: Download packaged distributions
+        uses: actions/download-artifact@v3
+
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          # This is already checked during the build.
+          verify-metadata: false
+          # Allow security-minded people to verify whether the files on PyPI
+          # were automatically uploaded by a CI script.
+          print-hash: true
 
   pr_dev_bump:
     permissions: