build: switch to trusted publishing (#10976)

Author: julian-risch

.github/workflows/nightly_testpypi_release.yml

@@ -12,6 +12,9 @@ env:
 jobs:
   nightly-release:
     runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
     # Always build from main for consistency (scheduled and manual runs)
     steps:
       - name: Checkout main
@@ -39,7 +42,4 @@ jobs:
         run: hatch build
 
       - name: Publish to PyPI
-        env:
-          HATCH_INDEX_USER: __token__
-          HATCH_INDEX_AUTH: ${{ secrets.HAYSTACK_AI_PYPI_TOKEN }}
-        run: hatch publish -y
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

.github/workflows/pypi_release.yml

@@ -13,6 +13,9 @@ env:
 jobs:
   release-on-pypi:
     runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
 
     steps:
       - name: Checkout
@@ -25,7 +28,4 @@ jobs:
         run: hatch build
 
       - name: Publish on PyPi
-        env:
-          HATCH_INDEX_USER: __token__
-          HATCH_INDEX_AUTH: ${{ secrets.HAYSTACK_AI_PYPI_TOKEN }}
-        run: hatch publish -y
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0