Use Github OIDC to publish release to TestPyPI

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: arc-runner
+    runs-on: acopar-runner
 
     env:
       RESOLWE_POSTGRESQL_PORT: 55433
@@ -110,8 +110,12 @@ jobs:
           tox -e ${{ matrix.toxenv }}-partial
 
   build:
-    runs-on: arc-runner
-    needs: test
+    runs-on: acopar-runner
+
+    permissions:
+      id-token: write
+      contents: read
+
     if: startsWith(github.ref, 'refs/tags')
 
     steps:
@@ -123,7 +127,7 @@ jobs:
       - name: Build a binary wheel and a source tarball
         run: python3.12 -m build --sdist --wheel --outdir dist/ .
 
-      - name: Publish distribution to PyPI
+      - name: Publish distribution to TestPyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.pypi_password }}
+          repository-url: https://test.pypi.org/legacy/