Use trusted publisher (#2877)

Co-authored-by: Adam Hopkins <[email protected]>

.github/workflows/publish-release.yml

@@ -19,6 +19,7 @@ jobs:
     outputs:
       docker-tags: ${{ steps.generate_docker_info.outputs.tags }}
       pypi-version: ${{ steps.parse_version_tag.outputs.pypi-version }}
+      is-test: ${{ env.IS_TEST }}
     steps:
       - name: Parse version tag
         id: parse_version_tag
@@ -90,6 +91,9 @@ jobs:
     name: Build and publish package
     runs-on: ubuntu-latest
     needs: generate_info
+    environment: release
+    permissions:
+      id-token: write
     steps:
     - name: Checkout repo
       uses: actions/checkout@v3
@@ -109,17 +113,16 @@ jobs:
     - name: Build a binary wheel and a source tarball
       run: python -m build --sdist --wheel --outdir dist/ .
 
-    - name: Publish to PyPi 🚀
-      run: twine upload --non-interactive --disable-progress-bar dist/*
-      env:
-        TWINE_USERNAME: __token__
-        TWINE_PASSWORD: ${{ env.IS_TEST == 'true' && secrets.SANIC_TEST_PYPI_API_TOKEN || secrets.SANIC_PYPI_API_TOKEN }}
-        TWINE_REPOSITORY: ${{ env.IS_TEST == 'true' && 'testpypi' || 'pypi' }}
+    - name: Publish package distribution
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: ${{ env.IS_TEST == 'true' && 'https://test.pypi.org/legacy/' || 'https://upload.pypi.org/legacy/' }}
 
   publish_docker:
     name: Publish Docker / Python ${{ matrix.python-version }}
     needs: [generate_info, publish_package]
     runs-on: ubuntu-latest
+    if: ${{ needs.generate_info.IS_TEST == 'false' }}
     strategy:
       fail-fast: true
       matrix: