From c62883735cf9c88db58fc68d3731e8ed0c597476 Mon Sep 17 00:00:00 2001
From: Claudio Ortega <claudio.rtega2701@gmail.com>
Date: Sun, 26 Jul 2026 13:12:52 -0700
Subject: [PATCH] Replace exposed PyPI token with trusted publishing

---
 .github/workflows/main.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 419b425..a8d80f8 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -77,6 +77,12 @@ jobs:
   deploy:
     needs: release
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/urbanpy
+    permissions:
+      contents: read
+      id-token: write
     steps:
     - uses: actions/checkout@v3
     - name: Set up Python
@@ -107,9 +113,7 @@ jobs:
       run: |
         python setup.py sdist bdist_wheel 
     - name: Publish distribution to PyPi
-      uses: pypa/gh-action-pypi-publish@master
-      with:
-        password: ${{ secrets.PYPI_API_TOKEN }}
+      uses: pypa/gh-action-pypi-publish@release/v1
     - uses: ammaraskar/sphinx-action@master
       with:
         docs-folder: "docs/"