Move publishing action to use the pypi action

.github/workflows/lemur-publish-release-pypi.yml

@@ -1,5 +1,5 @@
-# This workflow will upload a Python Package using Twine when a Lemur release is created via github
-# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries
+# This workflow will upload a Python Package to PyPI when a Lemur release is created via github
+# For more information see: https://github.com/marketplace/actions/pypi-publish
 
 name: Publish Lemur's latest package to PyPI
 
@@ -8,9 +8,13 @@ on:
     types: [created]
 
 jobs:
-  deploy:
-
+  pypi-publish:
+    name: upload release to PyPI
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-pypi
+      id-token: write
 
     steps:
     - uses: actions/checkout@v4
@@ -31,11 +35,9 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install setuptools wheel twine
-    - name: Build and publish
-      env:
-        TWINE_USERNAME: ${{ secrets.LEMUR_PYPI_API_USERNAME }}
-        TWINE_PASSWORD: ${{ secrets.LEMUR_PYPI_API_TOKEN }}
+        pip install setuptools wheel
+    - name: Build package
       run: |
         python setup.py sdist bdist_wheel
-        twine upload dist/*
+    - name: Publish package distributions to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1