TODO: Consider Trusted Publishing

[abravalheri]

The benefits of PEP 740 are you get SigStore attestations for the artifacts on PyPI & there's no password or long-lived token to leak. You just set it up on PyPI and then use the action.

• https://docs.pypi.org/trusted-publishers/
• https://learn.scientific-python.org/development/guides/gha-pure/ (near bottom of page)
• https://sethmlarson.dev/python-and-sigstore

Originally posted by @henryiii in #237 (comment)

[henryiii]

We need to do this. Recent attacks, like the LiteLLM attack would have been thwarted by trusted publishing. A rouge GitHub action (and we don't pin our actions by SHAs or have a cooldown) was able to read the runner memory and extract the PyPI token; this can't happen for Trusted Publishing since the token is short lived.