ci: trusted (#479)

* trusted publish

* ci: trusted publish

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

---------

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

.github/workflows/cd.yml

@@ -25,18 +25,17 @@ jobs:
     - name: Check metadata
       run: pipx run twine check dist/*
 
+  publish:
+    needs: [dist]
+    environment: release
+    permissions:
+      id-token: write
+    runs-on: ubuntu-latest
+    if: github.event_name == 'release' && github.event.action == 'published'
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: Packages
+          path: dist
 
-publish:
-  needs: [dist]
-  environment: release
-  permissions:
-    id-token: write
-  runs-on: ubuntu-latest
-  if: github.event_name == 'release' && github.event.action == 'published'
-  steps:
-    - uses: actions/download-artifact@v4
-      with:
-        name: Packages
-        path: dist
-
-    - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@release/v1