release: 1.2.1

- Switch PyPI publishing to OIDC trusted publisher (id-token: write,
  pypa/gh-action-pypi-publish) and drop the PYPI_TOKEN secret usage
- Bump theme version to 1.2.1

Signed-off-by: Gabriel Harris-Rouquette <gabizou@me.com>

Author: gabizou

.github/workflows/build.yml

@@ -38,6 +38,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     if: startsWith(github.ref, 'refs/tags')
+    permissions:
+      id-token: write
+      contents: read
     steps:
     - uses: actions/checkout@v6
     - name: Setup Node.js
@@ -56,18 +59,15 @@ jobs:
       run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt
-          pip install setuptools wheel twine
+          pip install setuptools wheel
     - name: Build for publishing
       run: |
           ./node_modules/.bin/gulp clean
           ./node_modules/.bin/gulp theme:build
     - name: Setup for publishing
       run: python setup.py sdist bdist_wheel
     - name: Publish
-      run: twine upload dist/*.*
-      env:
-        TWINE_USERNAME: __token__
-        TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+      uses: pypa/gh-action-pypi-publish@release/v1
 
   publish-docker:
     runs-on: ubuntu-latest

src/theme/__init__.py

@@ -1,4 +1,4 @@
-VERSION = (1, 2, 0)
+VERSION = (1, 2, 1)
 __version__ = '.'.join(str(v) for v in VERSION)