use trusted publisher routine for PyPI and retire token-based type (#4150)

Author: valeriupredoi

.github/workflows/pypi-build-and-deploy.yml

@@ -13,6 +13,12 @@ jobs:
   build-n-publish:
     name: Build and publish ESMValTool on PyPi
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/ESMValTool/
+    permissions:
+      # IMPORTANT: this permission is mandatory for trusted publishing
+      id-token: write
     steps:
       - uses: actions/checkout@v5
         with:
@@ -35,18 +41,10 @@ jobs:
           --binary
           --out-dir dist/
           .
-      # Publish on Test PyPi; uncomment to test
-      # and remember to adjust the triggers above
-      # - name: Publish distribution 📦 to Test PyPI
-      #   uses: pypa/gh-action-pypi-publish@master
+      # - name: Publish distribution to Test PyPI
+      #   uses: pypa/gh-action-pypi-publish@release/v1.12.4
       #   with:
-      #     password: ${{ secrets.test_pypi_password }}
-      #     repository_url: https://test.pypi.org/legacy/
-
-      # Publish on PyPi
+      #     repository-url: https://test.pypi.org/legacy/
       - name: Publish distribution 📦 to PyPI
         if: startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@v1.5.0
-        with:
-          user: __token__
-          password: ${{ secrets.pypi_password }}
+        uses: pypa/gh-action-pypi-publish@release/v1.12.4