Update publish workflow for trusted publishers

[jtpio]

References

Start using trusted publishers for publishing Voila to PyPI.

This will help to not have to deal with 2FA with the bot account: https://blog.pypi.org/posts/2024-01-01-2fa-enforced/

Code changes

• Update publish-release.yml to remove the PyPI token and set up id-token
• Setup voila on PyPI to use trusted publishers

User-facing changes

None

Backwards-incompatible changes

None

[github-actions]

👈 Launch a Binder on branch jtpio/voila/trusted-publisher

[jtpio]

We can then remove voila-bot from PyPI after this is merged.

[martinRenou]

Thanks

[jtpio]

We can then remove voila-bot from PyPI after this is merged.

And the PYPI_TOKEN in the repo secrets.

Looks like voila-bot was only used for 2 projects on PyPI:

[martinRenou]

Happy to remove that bot, thank you!

[jtpio]

Just removed it from PyPI. I think we need to keep as Admin on the repos though.

[martinRenou]

I think we need to keep as Admin on the repos though.

Why?

[jtpio]

Because it's still the bot creating the GitHub releases:

There is also still the need to the admin github token. But this might not be needed in a future version of the releaser: jupyter-server/jupyter_releaser#545

[martinRenou]

Ok 👍🏽