chore: allow CI to read PyPI token

.github/workflows/release.yml

@@ -6,7 +6,7 @@ name: build & release
 on:
   # Triggers the workflow on push or pull request events but only for the master branch
   push:
-    branch: [main, master]
+    branch: main
     tags:
       - 'v*'
 
@@ -22,6 +22,10 @@ jobs:
       matrix:
         python-versions: ['3.10']
 
+    # authorize job to read secrets
+    permissions:
+      id-token: write
+
     # map step outputs to job outputs so they can be share among jobs
     outputs:
       package_version: ${{ steps.variables_step.outputs.package_version }}