Further fix to pypi upload in cd.yml

Set contents to write in publish release

Author: mgkwill

.github/workflows/cd.yml

@@ -137,8 +137,8 @@ jobs:
     outputs:
           api-token: ${{ steps.mint-token.outputs.api-token}}
     permissions:
-      contents: write
-      id-token: write      
+      id-token: write
+      contents: write   
     needs: [build-artifacts, test-artifact-install, test-artifact-use]
 
     steps:
@@ -206,4 +206,5 @@ jobs:
         run: |
           mkdir dist
           cp lava* dist/.
+          echo "::add-mask::${{ steps.mint-token.outputs.api-token }}"
           poetry publish -u __token__ -p '${{ steps.mint-token.outputs.api-token }}'