From cb5c822eb4ff8aa84222e582dba5d25bccbb9145 Mon Sep 17 00:00:00 2001
From: Nick Sweeting <git@sweeting.me>
Date: Sun, 14 Jun 2026 10:47:44 -0700
Subject: [PATCH] ci: use pypi trusted publishing in release state

---
 .github/workflows/release-runner.yml | 1 +
 bin/release.sh                       | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-runner.yml b/.github/workflows/release-runner.yml
index f4cc06bd..8ba3a330 100644
--- a/.github/workflows/release-runner.yml
+++ b/.github/workflows/release-runner.yml
@@ -19,6 +19,7 @@ jobs:
   release-state:
     if: github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'release:')
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - uses: actions/checkout@v4
         with:
diff --git a/bin/release.sh b/bin/release.sh
index a41b3573..c312f686 100755
--- a/bin/release.sh
+++ b/bin/release.sh
@@ -409,7 +409,7 @@ publish_artifacts() {
         if [[ -n "${pypi_token}" ]]; then
             UV_PUBLISH_TOKEN="${pypi_token}" uv publish --username=__token__ "${artifacts[@]}"
         else
-            uv publish --username=__token__ "${artifacts[@]}"
+            uv publish --trusted-publishing always "${artifacts[@]}"
         fi
     fi