Change PyPI deploy to rely on "trusted publishers" (#3400)

.github/workflows/deploy-release.yml

@@ -1,28 +1,22 @@
-name: deploy-release
-
+name: Deploy release
 on:
   push:
     tags:
-    - '*'
-
+      - '*'
 jobs:
   pypi:
+    permissions:
+      id-token: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - name: Setup Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.10'
-      - name: Install Hatch
-        run: |
-          python -m pip install -U hatch
+          python-version: '3.11'
+      - name: Install dependencies
+        run: pip install -U build
       - name: Build package
-        run: |
-          hatch build
-      - name: Publish
-        run: |
-          hatch publish
-        env:
-          HATCH_INDEX_USER: __token__
-          HATCH_INDEX_AUTH: ${{ secrets.PYPI_PASSWORD }}
+        run: python -m build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1