From 5839537f56fd6535e6228d268236191a07f4334a Mon Sep 17 00:00:00 2001
From: JiJi <i@mmdjiji.com>
Date: Fri, 15 May 2026 22:46:47 +0800
Subject: [PATCH] feat: use Trusted Publisher Management instead of API Token

---
 .github/workflows/{ci.yml => publish.yml} | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
 rename .github/workflows/{ci.yml => publish.yml} (81%)

diff --git a/.github/workflows/ci.yml b/.github/workflows/publish.yml
similarity index 81%
rename from .github/workflows/ci.yml
rename to .github/workflows/publish.yml
index dabecdb..fb4b4c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/publish.yml
@@ -1,4 +1,4 @@
-name: CI
+name: Publish to PyPI
 
 on:
   push:
@@ -18,6 +18,11 @@ jobs:
   publish-pypi:
     name: Publish to PyPI
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/pdfuck
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -26,6 +31,3 @@ jobs:
       - run: uv build
       - name: Publish a Python distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}