Update release.yml

.github/workflows/release.yml

@@ -11,7 +11,8 @@ jobs:
     permissions:
       # This permission is required for trusted publishing.
       id-token: write
-
+      contents: read
+
     steps:
       - uses: actions/checkout@v3
 
@@ -30,23 +31,10 @@ jobs:
             poetry version ${{  github.ref_name }}
             poetry build
             
-      - name: Publish package to PyPI
+      - name: Mint token
+        id: mint
+        uses: tschm/[email protected]
+
+      - name: Publish the package with poetry
         run: |
-            # retrieve the ambient OIDC token
-            resp=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
-                           "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=pypi")
-                           
-            # extract the token from the response
-            oidc_token=$(jq -r '.value' <<< "${resp}")            
-            
-            # and move the token into json format
-            oidc_token="{\"token\":\"${oidc_token}\"}"
-            
-            # use the oidc token to request an api token
-            resp=$(curl -X POST https://pypi.org/_/oidc/github/mint-token -d $oidc_token)
-            
-            # extract the token from the response
-            api_token=$(jq -r '.token' <<< "${resp}")
-            
-            # publish the package with poetry
-            poetry publish -u __token__ -p ${api_token}
+            poetry publish -u __token__ -p '${{ steps.mint.outputs.api-token }}'