use trusted publishing

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 04527b7ad7fd5a10dc79d968e79d54f7df5a32b9..0000815a17cc41263f56dc360ca34a5d05bfe61b 100644 (file)
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -58,12 +58,14 @@ jobs:
     # files in the draft release.
     environment: 'publish'
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
       - uses: pypa/gh-action-pypi-publish@2f6f737ca5f74c637829c0f5c3acd0e29ea5e8bf
         with:
-          repository_url: https://test.pypi.org/legacy/
-          packages_dir: artifact/
+          repository-url: https://test.pypi.org/legacy/
+          packages-dir: artifact/
       - uses: pypa/gh-action-pypi-publish@2f6f737ca5f74c637829c0f5c3acd0e29ea5e8bf
         with:
-          packages_dir: artifact/
+          packages-dir: artifact/