use tag for now

Author: kevinjqliu

.github/workflows/nightly-pypi-build.yml

@@ -86,7 +86,7 @@ jobs:
     - name: Publish to TestPyPI
       id: publish-testpypi
       continue-on-error: true
-      uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
+      uses: pypa/gh-action-pypi-publish@release/v1 # zizmor: ignore[unpinned-uses] -- until asf-infra publishes new allowlist with commit hash
       with:
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true