ci: use newer trusted publishing for pypi

.github/workflows/pypi.yml

@@ -9,6 +9,11 @@ jobs:
   build-n-publish:
     name: Build and publish Python 🐍 distributions 📦 to PyPI
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/viv
+    permissions:
+      id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
     steps:
       - uses: actions/checkout@v3
         with:
@@ -23,7 +28,6 @@ jobs:
       - name: Build a binary wheel and a source tarball
         run: >-
           python -m build --sdist --wheel --outdir dist/ .
-      - name: Publish a Python distribution to PyPI
+
+      - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}