update pypi release workflow to use trusted env

.github/workflows/release_gcp.yaml

@@ -12,7 +12,7 @@ env:
 
 jobs:
   publish:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     permissions:
       contents: 'read'
       id-token: 'write'

.github/workflows/release_pypi.yaml

@@ -1,23 +1,21 @@
 name: Release -  PyPI
 
 on:
-    push:
-      tags:
-        - 'v*'  # Trigger on version tags
-    workflow_dispatch:
-      inputs:
-        tag:
-          description: 'Tag to release (e.g., v1.0.0)'
-          required: true
-          type: string
+  release:
+    types: [published]
+  workflow_dispatch:
 
 jobs:
   publish:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
+
     permissions:
       contents: read
       id-token: write
 
+    environment:
+      name: pypi
+
     steps:
     - name: Checkout
       uses: actions/checkout@v4
@@ -35,8 +33,16 @@ jobs:
     - name: Build package
       run: python -m build
 
-    - name: Upload to PyPI
-      env:
-        TWINE_REPOSITORY: testpypi
+    - name: Check distribution
       run: |
-        twine upload --verbose dist/*
+        twine check dist/*
+        if [ $? -ne 0 ]; then
+          echo "Invalid distribution files"
+          exit 1
+        fi
+
+    - name: Publish to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        repository-url: https://test.pypi.org/legacy/
+        packages-dir: dist/