pypi trusted publishing

.github/workflows/build-wheels.yml

@@ -11,11 +11,11 @@ on:
         default: "main"
         type: string
       test_pypi_publish:
-        description: "Publish to Test PyPi (true | false)"
+        description: "Publish to Test PyPi"
         default: false
         type: boolean
       pypi_publish:
-        description: "Publish to PyPi (true | false)"
+        description: "Publish to PyPi"
         default: false
         type: boolean
 
@@ -26,11 +26,11 @@ on:
         default: "main"
         type: string
       test_pypi_publish:
-        description: "Publish to Test PyPi (true | false)"
+        description: "Publish to Test PyPi"
         default: false
         type: boolean
       pypi_publish:
-        description: "Publish to PyPi (true | false))"
+        description: "Publish to PyPi"
         default: false
         type: boolean
 
@@ -54,28 +54,44 @@ jobs:
         with:
           path: dist/*
 
-  upload_pypi:
-    name: Upload to PyPI (optional)
+  upload_test_pypi:
+    name: Upload to test PyPI (optional)
+    if: ${{ github.event.inputs.test_pypi_publish == 'true' }}
     needs: [build]
     runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/fenics-ufl
+    permissions:
+      id-token: write
+
     steps:
       - uses: actions/download-artifact@v4
         with:
           name: artifact
           path: dist
 
-      - name: Push to PyPI
+      - name: Push to test PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        if: ${{ github.event.inputs.pypi_publish == 'true' }}
         with:
-          user: __token__
-          password: ${{ secrets.PYPI_TOKEN }}
-          repository-url: https://upload.pypi.org/legacy/
+          repository-url: https://test.pypi.org/legacy/
+
+  upload_pypi:
+    name: Upload to PyPI (optional)
+    if: ${{ github.event.inputs.pypi_publish == 'true' }}
+    needs: [build]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/fenics-ufl
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: artifact
+          path: dist
 
-      - name: Push to Test PyPI
+      - name: Push to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        if: ${{ github.event.inputs.test_pypi_publish == 'true' }}
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_TEST_TOKEN }}
-          repository-url: https://test.pypi.org/legacy/