Switch to pypa's publish action

Turns out maturin's publish is deprecated and will be removed
eventually, and as pypa handles attestations internally they can use
whatever they / pypi thinks best and I don't need to look at it.

Author: masklinn

.github/workflows/release-wheels.yml

@@ -236,25 +236,21 @@ jobs:
     permissions:
       # Use to sign the release artifacts
       id-token: write
-      # necessary to create the artifact storage record.
-      artifact-metadata: write
-      # Used to generate artifact attestation
-      attestations: write
     environment: release
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # 8.0.1
         with:
           path: dist
           merge-multiple: true  # dump every wheel file in the same directory
-      - name: Generate artifact attestation
-        if: github.event_name == 'workflow_dispatch'
-        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26  # 4.1.0
-        with:
-          subject-path: 'dist/*'
       - name: Publish to PyPI
-        uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad  # 1.50.1
+        if: github.event.name == 'workflow_dispatch' && inputs.release
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # 1.13.0
+        with:
+          verbose: true
+      - name: Publish to TestPyPI
+        if: github.event.name != 'workflow_dispatch' || !inputs.release
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # 1.13.0
         with:
-          command: upload
-          args: --non-interactive --skip-existing dist/*
-        env:
-          MATURIN_REPOSITORY: ${{ (github.event_name == 'workflow_dispatch' && inputs.release) && 'pypi' || 'testpypi' }}
+          repository-url: https://test.pypi.org/legacy/
+          verbose: true
+          skip-existing: true