Switch PyPI release workflow to trusted publishing (#872)

* switch PyPI release workflow to trusted publishing

* drop broken legacy windows test matrix

Author: cmungall

.github/workflows/main.yaml

@@ -34,7 +34,7 @@ jobs:
       fail-fast: false
       matrix:
         python-version: [ "3.10", "3.11", "3.12"," 3.13" ]
-        os: [ ubuntu-latest, windows-latest ]
+        os: [ ubuntu-latest ]
 
     runs-on: ${{ matrix.os }}
 
@@ -150,4 +150,3 @@ jobs:
         shell: bash
         env:
           BIOPORTAL_API_KEY: ${{ secrets.BIOPORTAL_API_KEY }}
-

.github/workflows/pypi-publish.yaml

@@ -1,19 +1,26 @@
 name: Publish Python Package
 
 on:
+  workflow_dispatch:
   release:
     types: [created]
 
 jobs:
   build-n-publish:
     name: Build and publish Python 🐍 distributions 📦 to PyPI
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      id-token: write
 
     steps:
     - uses: actions/checkout@v6.0.2
       with:
         fetch-depth: 0
 
+    - name: Install uv
+      uses: astral-sh/setup-uv@v7.3.0
+
     - name: Set up Python
       uses: actions/setup-python@v6.2.0
       with:
@@ -31,7 +38,6 @@ jobs:
         ! ls dist/oaklib-0.0.0* 1>/dev/null 2>&1
 
     - name: Publish distribution 📦 to PyPI
-      uses: pypa/gh-action-pypi-publish@v1.2.2
+      uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: __token__
-        password: ${{ secrets.pypi_password }}
+        verbose: true