Switch to trusted publishing (#2)

* ci: Switch to trusted pubisher

* ci: Update publish notes

---------

Co-authored-by: a.b.christie <alan.christie@matildapeak.com>

Author: achristie-im

.github/workflows/publish.yaml

@@ -1,31 +1,15 @@
 ---
-name: publish
-
-# Actions for any tag.
 
-# -----------------
-# Control variables (GitHub Secrets)
-# -----------------
-#
-# At the GitHub 'organisation' or 'project' level you must have the following
-# GitHub 'Repository Secrets' defined (i.e. via 'Settings -> Secrets'): -
-#
-# PYPI_USERNAME
-# PYPI_TOKEN
-#
-# -----------
-# Environment (GitHub Environments)
-# -----------
-#
-# Environment         (none)
+# Publish the application to PyPI
+name: publish
 
 on:
   push:
     tags:
     - '**'
 
 jobs:
-  build-and-publish:
+  build:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
@@ -44,8 +28,27 @@ jobs:
       run: |
         echo $GITHUB_REF_SLUG > src/squeck/VERSION
         uv build
+    - name: Store the distribution
+      uses: actions/upload-artifact@v5
+      with:
+        name: python-package-distribution
+        path: dist/
+
+  publish:
+    name: Publish to PyPI
+    needs:
+    - build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/xchem-hippo
+    permissions:
+      id-token: write
+    steps:
+    - name: Download distribution
+      uses: actions/download-artifact@v6
+      with:
+        name: python-package-distribution
+        path: dist/
     - name: Publish
       uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        user: ${{ secrets.PYPI_USERNAME }}
-        password: ${{ secrets.PYPI_TOKEN }}

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2023 Informatics Matters Ltd
+Copyright (c) 2026 Informatics Matters Ltd
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal