use trusted publishing for pypi

.github/workflows/pypi_upload.yml

@@ -37,6 +37,7 @@ jobs:
       - name: Build a source tarball
         env:
           LIBCST_NO_LOCAL_SCHEME: 1
+          SETUPTOOLS_SCM_PRETEND_VERSION: 0.0.1
         run: >-
           hatch run python -m
           build
@@ -46,14 +47,10 @@ jobs:
         if: github.event_name == 'push'
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
           repository-url: https://test.pypi.org/legacy/
           packages-dir: ${{ steps.download.outputs.download-path }}
       - name: Publish distribution 📦 to PyPI
         if: github.event_name == 'release'
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
           packages-dir: ${{ steps.download.outputs.download-path }}