chore: configure publisher workflow for the trusted publisher approach

Author: emre.akkaya

.github/workflows/python-package.yml

@@ -13,6 +13,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
 
     steps:
       - name: Checkout repository
@@ -35,7 +36,5 @@ jobs:
         run: make build
 
       - name: Publish to PyPI
-        if: startsWith(github.ref, 'refs/tags/')
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}