Refactor GitHub Actions for PyPI publishing (#3334)

Commented out the publish-pypi-test and publish-delayed jobs. Updated publish-pypi-main to remove dependency on publish-delayed and added permissions.

Author: justusschock

.github/workflows/publish-pkg.yml

@@ -54,39 +54,41 @@ jobs:
           files: "dist/*"
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-  publish-pypi-test:
-    needs: build-package
-    if: startsWith(github.event.ref, 'refs/tags') || github.event_name == 'release'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/download-artifact@v5
-        with:
-          name: pypi-packages-${{ github.sha }}
-          path: dist
-      - run: ls -lh dist/
-      # We do this, since failures on test.pypi aren't that bad
-      - name: Publish to Test PyPI
-        uses: pypa/gh-action-pypi-publish@v1.13.0
-        with:
-          user: __token__
-          password: ${{ secrets.test_pypi_password }}
-          repository_url: https://test.pypi.org/legacy/
-          verbose: true
+  # publish-pypi-test:
+  #   needs: build-package
+  #   if: startsWith(github.event.ref, 'refs/tags') || github.event_name == 'release'
+  #   runs-on: ubuntu-latest
+  #   timeout-minutes: 5
+  #   steps:
+  #     - uses: actions/download-artifact@v5
+  #       with:
+  #         name: pypi-packages-${{ github.sha }}
+  #         path: dist
+  #     - run: ls -lh dist/
+  #     # We do this, since failures on test.pypi aren't that bad
+  #     - name: Publish to Test PyPI
+  #       uses: pypa/gh-action-pypi-publish@v1.13.0
+  #       with:
+  #         user: __token__
+  #         password: ${{ secrets.test_pypi_password }}
+  #         repository_url: https://test.pypi.org/legacy/
+  #         verbose: true
 
-  publish-delayed:
-    needs: publish-pypi-test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: juliangruber/sleep-action@v2
-        with:
-          time: 5m
+  # publish-delayed:
+  #   needs: publish-pypi-test
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - uses: juliangruber/sleep-action@v2
+  #       with:
+  #         time: 5m
 
   publish-pypi-main:
-    needs: [build-package, publish-delayed]
+    needs: [build-package] #, publish-delayed]
     if: startsWith(github.event.ref, 'refs/tags') || github.event_name == 'release'
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      id-token: write
     steps:
       - uses: actions/download-artifact@v5
         with:
@@ -95,7 +97,3 @@ jobs:
       - run: ls -lh dist/
       - name: Publish distribution 📦 to PyPI
         uses: pypa/gh-action-pypi-publish@v1.13.0
-        with:
-          user: __token__
-          password: ${{ secrets.pypi_password }}
-          verbose: true