From 0cbcfc44901d73711c76201c20c6c6ad0eead393 Mon Sep 17 00:00:00 2001
From: Mattia Almansi <m.almansi@bopen.eu>
Date: Mon, 16 Oct 2023 09:48:08 +0200
Subject: [PATCH] template update

---
 .cruft.json                   | 2 +-
 .github/workflows/on-push.yml | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.cruft.json b/.cruft.json
index d77cf3f..eb58315 100644
--- a/.cruft.json
+++ b/.cruft.json
@@ -1,6 +1,6 @@
 {
   "template": "https://github.com/ecmwf-projects/cookiecutter-conda-package",
-  "commit": "e1fc4734213fe5ff14f1d95c755a9f25448447bc",
+  "commit": "22b85d3aca63d05f4a19f1a531bcea311617f4cd",
   "checkout": null,
   "context": {
     "cookiecutter": {
diff --git a/.github/workflows/on-push.yml b/.github/workflows/on-push.yml
index 1a1bd9b..4540378 100644
--- a/.github/workflows/on-push.yml
+++ b/.github/workflows/on-push.yml
@@ -168,6 +168,11 @@ jobs:
   distribution:
     runs-on: ubuntu-latest
     needs: [unit-tests, type-check, docs-build, integration-tests]
+    environment:
+      name: pypi
+      url: https://pypi.org/p/cacholote
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publish
     if: |
       always() &&
       needs.unit-tests.result == 'success' &&
@@ -192,6 +197,3 @@ jobs:
     - name: Publish a Python distribution to PyPI
       if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
       uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}