Upgrade PyPI CI publishing to use Trusted Publishing

.github/workflows/ci_workflows.yml

@@ -40,6 +40,8 @@ jobs:
     needs: tests
     uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish.yml@2835f0cacddf3f8de198db9afdb5354a5cebe0ef  # v2.6.3
     with:
+      upload_to_pypi: false
+      save_artifacts: true
       test_extras: test
       test_command: pytest -p no:warnings --pyargs reproject --log-cli-level=INFO
       targets: |
@@ -57,5 +59,31 @@ jobs:
       anaconda_keep_n_latest: 10
 
     secrets:
-      pypi_token: ${{ secrets.pypi_token }}
       anaconda_token: ${{ secrets.anaconda_token }}
+
+  upload:
+    permissions:
+      id-token: write
+    environment:
+      name: pypi
+      url: https://pypi.org/project/reproject
+    if: >-
+      ${{ startsWith(github.ref, 'refs/tags/v') &&
+          !endsWith(github.ref, '.dev') &&
+          (
+            github.event_name == 'push' ||
+            github.event_name == 'workflow_dispatch'
+          )
+      }}
+    name: Upload release to PyPI
+    runs-on: ubuntu-latest
+    needs: [publish]
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          merge-multiple: true
+          pattern: dist-*
+          path: dist
+      - name: Upload to PyPI
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0