chore: switch to trusted publisher

Signed-off-by: Frost Ming <me@frostming.com>

.github/workflows/release.yml

@@ -9,37 +9,38 @@ jobs:
   release-pypi:
     name: release-pypi
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/unearth
+    permissions:
+      id-token: write
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
-          node-version: 16
+          node-version: 18
 
       - run: npx changelogithub
         continue-on-error: true
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
 
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.12"
 
       - name: Build artifacts
         run: |
-          pip install build
-          python -m build
+          pipx run build
 
       - name: Test Build
         run: |
-          python3 -m venv fresh_env
-          . fresh_env/bin/activate
           pip install dist/*.whl
+          unearth flask
 
-      - name: Upload to Pypi
-        run: |
-          pip install twine
-          twine upload --username __token__ --password ${{ secrets.PYPI_TOKEN }} dist/*
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1