Repository: canonical/operator (language: python)

Issue:
Use PyPI's "Trusted Publisher" functionality to publish packages
It'd likely be worth moving to PyPI's [Trusted Publisher](https://docs.pypi.org/trusted-publishers/) system (basically, using OIDC rather than API tokens or username/passwords). From a security point of view it's tighter because the tokens are short-lived and scoped tightly to the specific package.


Discussion / hints:
@benhoyt the first half of this requires [a short config on PyPI](https://docs.pypi.org/trusted-publishers/adding-a-publisher/), so you'll need to do that part. Feel free to pass back to me after that to adjust the workflow, or just do that yourself as well.
Done!

Fix patch:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5067849ec..7928bf3bc 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,6 +14,8 @@ jobs:
   build-n-publish:
     name: Build and Publish to PyPI
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     needs: [framework-tests, observability-charm-tests, hello-charm-tests]
     steps:
       - uses: actions/checkout@v3
@@ -25,5 +27,3 @@ jobs:
         run: python -m build
       - name: Publish
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}


Test patch:
diff --git a/.github/workflows/test-publish.yml b/.github/workflows/test-publish.yml
new file mode 100644
index 000000000..cf9c562bb
--- /dev/null
+++ b/.github/workflows/test-publish.yml
@@ -0,0 +1,30 @@
+name: Test Publish
+on: [workflow_dispatch, workflow_call]
+
+jobs:
+  framework-tests:
+    uses: ./.github/workflows/framework-tests.yaml
+  observability-charm-tests:
+    uses: ./.github/workflows/observability-charm-tests.yaml
+  hello-charm-tests:
+    uses: ./.github/workflows/hello-charm-tests.yaml
+  build-n-publish:
+    name: Build and Publish to Test PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    needs: [framework-tests, observability-charm-tests, hello-charm-tests]
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup Python
+        uses: actions/setup-python@v1
+        with:
+          python-version: "3.10"
+      - name: Install wheel
+        run: pip install wheel
+      - name: Build
+        run: python setup.py sdist bdist_wheel
+      - name: Publish to test.pypi.org
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/