Trusted publishing wasn't the issue 🤦

.github/workflows/release.yml

@@ -13,8 +13,14 @@ jobs:
     name: Build and release Python package
     runs-on: ubuntu-latest
 
-    # Python release tags start with "py/v*"
-    if: startsWith(github.ref, 'refs/tags/py/v')
+    if: startsWith(github.ref, 'refs/tags/v')
+
+    environment:
+      name: pypi
+      url: https://pypi.org/project/chatlas/
+
+    permissions:  # for trusted publishing
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -44,6 +50,3 @@ jobs:
 
       - name: 🚢 Publish release on PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}