Update CI

.github/workflows/CI.yml

@@ -1,4 +1,6 @@
 name: CI
+permissions:
+  contents: read
 
 on:
   pull_request:
@@ -9,7 +11,7 @@ jobs:
   tests:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Run tests
       run: |
         set -euo pipefail
@@ -36,7 +38,7 @@ jobs:
             manylinux: musllinux_1_2
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Build wheels
       uses: PyO3/maturin-action@v1
       with:
@@ -47,7 +49,7 @@ jobs:
         container: ${{ matrix.platform.container }}
         args: --release -o dist --find-interpreter
     - name: Upload wheels
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: wheel-linux-${{ matrix.platform.target }}
         path: dist/*
@@ -57,15 +59,15 @@ jobs:
     needs: [ tests ]
     runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Build wheels
       uses: PyO3/maturin-action@v1
       with:
         command: build
         rust-toolchain: stable
         args: --release -o dist --find-interpreter
     - name: Upload wheels
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: wheel-windows
         path: dist/*
@@ -81,55 +83,50 @@ jobs:
           - x86_64-apple-darwin
     runs-on: macos-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
     - name: Build wheels
       uses: PyO3/maturin-action@v1
       with:
         command: build
         rust-toolchain: stable
         args: --release -o dist --find-interpreter --target ${{ matrix.target }}
     - name: Upload wheels
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v6
       with:
         name: wheel-macos-${{ matrix.target }}
         path: dist/*
         retention-days: 1
 
-  test-release:
-    name: Test release
+  publish_testpypi:
+    name: Publish to test.pypi.org
     runs-on: ubuntu-latest
-    if: "!startsWith(github.ref, 'refs/tags/')"
+    if: >
+      github.event_name == 'release' && github.event.action == 'published' && github.event.release.prerelease == true
     needs: [ macos, windows, linux ]
+    permissions:
+      id-token: write
+    environment: testpypi
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           path: dist
           merge-multiple: true
-      - name: Publish to PyPI
-        uses: PyO3/maturin-action@v1
-        env:
-          MATURIN_PYPI_TOKEN: ${{ secrets.TEST_PYPI_API_TOKEN }}
-          MATURIN_NON_INTERACTIVE: true
-          MATURIN_REPOSITORY_URL: https://test.pypi.org/legacy/
+      - uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          command: upload
-          args: --skip-existing dist/*
+          repository-url: https://test.pypi.org/legacy/
 
-  release:
-    name: Release
+  publish_pypi:
+    name: Publish to pypi.org
     runs-on: ubuntu-latest
-    if: "startsWith(github.ref, 'refs/tags/')"
+    if: >
+      github.event_name == 'release' && github.event.action == 'published' && github.event.release.prerelease == false
     needs: [ macos, windows, linux ]
+    permissions:
+      id-token: write
+    environment: pypi
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           path: dist
           merge-multiple: true
-      - name: Publish to PyPI
-        uses: PyO3/maturin-action@v1
-        env:
-          MATURIN_PYPI_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
-          MATURIN_NON_INTERACTIVE: true
-        with:
-          command: upload
-          args: --skip-existing dist/*
+      - uses: pypa/gh-action-pypi-publish@release/v1