Refactor release to support trusted publishers (#373)

.github/workflows/release.yml

@@ -12,30 +12,33 @@ jobs:
     name: Build and publish to PyPI
     if: startsWith(github.event.ref, 'refs/tags')
     runs-on: ubuntu-20.04
+    environment:
+      name: release
+      url: https://pypi.org/p/crc-bonfire
+    permissions:
+      # mandatory for trusted publishing
+      id-token: write
+
     steps:
       - name: Checkout to master
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: '3.10'
           architecture: 'x64'
 
       - name: Install build dependencies
         run: |
-          python -m pip install -U pip
-          pip install -U wheel setuptools build twine
+          pip install build twine
 
       - name: Build sdist and wheel
         run: |
           python -m build -o dist/
-      
+
       - name: Twine check
         run: python -m twine check dist/*
 
       - name: Deploy to PyPi
-        uses: pypa/gh-action-pypi-publish@master
-        with:
-          user: __token__
-          password: ${{ secrets.pypi_token }}
+        uses: pypa/gh-action-pypi-publish@release/v1