use the 'trusted publisher' workflow

.github/workflows/publish.yml

@@ -7,13 +7,31 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    # https://docs.pypi.org/trusted-publishers/using-a-publisher/
+    environment: release
+    permissions:
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3
 
-      - name: Build and publish to pypi
-        uses: JRubics/[email protected]
+      - name: Install Poetry
+        run: |
+          pipx install poetry
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
         with:
-          python_version: "3.9"
-          pypi_token: ${{ secrets.PYPI_TOKEN }}
-          ignore_dev_requirements: yes
+          python-version: '3.9'
+          cache: 'poetry'
+
+      - name: Install dependencies
+        run: |
+          poetry install
+
+      - name: Build
+        run: |
+          poetry build
+
+      - name: Publish to pypi
+        uses: pypa/gh-action-pypi-publish@release/v1