Unify PyPI releases with GitHub OIDC

.github/workflows/pypi_release.yml → .github/workflows/release.yml

@@ -4,15 +4,16 @@ on:
   push:
     tags:
       - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
-    branches:
-      - master
 
 jobs:
   release-pipeline:
-
     runs-on: ubuntu-latest
-    strategy:
-      max-parallel: 4
+    environment: release
+    permissions:
+      # Used to authenticate to PyPI via OIDC and sign the release's artifacts with sigstore-python.
+      id-token: write
+      # Used to attach signing artifacts to the published release.
+      contents: write
 
     steps:
       - uses: actions/checkout@v4
@@ -37,7 +38,4 @@ jobs:
           python -m build
 
       - name: Publish distribution 📦 to PyPI
-        if: startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.LABS_PYPI_TOKEN }}
+        uses: pypa/gh-action-pypi-publish@release/v1