Merging upstream version 1.13.

Signed-off-by: Daniel Baumann <daniel@debian.org>

.github/workflows/release-python.yml

@@ -6,15 +6,14 @@ on:
     branches: [master]
     tags:
       - '**'
-  pull_request:
-    branches: [master]
-
   workflow_dispatch:
 
 jobs:
   build_sdist:
     name: Build source distribution
     runs-on: ubuntu-latest
+    env:
+      PYTHON_VERSION: "3.10"
     container:
       image: ghcr.io/linux-nvme/debian.python:latest
     steps:
@@ -34,7 +33,11 @@ jobs:
   upload_test_pypi:
     needs: [build_sdist]
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/v')
+    env:
+      PYTHON_VERSION: "3.10"
+    environment: pypi
+    permissions:
+      id-token: write
     steps:
       - uses: actions/download-artifact@v4
         with:
@@ -42,15 +45,18 @@ jobs:
           path: dist
 
       - name: Publish package to TestPyPI
-        uses: pypa/gh-action-pypi-publish@release/v1.12
+        uses: pypa/gh-action-pypi-publish@v1.12.4
         with:
-          user: __token__
-          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-          repository_url: https://test.pypi.org/legacy/
+          repository-url: https://test.pypi.org/legacy/
 
   upload_pypi:
     needs: [build_sdist]
     runs-on: ubuntu-latest
+    env:
+      PYTHON_VERSION: "3.10"
+    environment: pypi
+    permissions:
+      id-token: write
     if: startsWith(github.ref, 'refs/tags/v') && github.repository == 'linux-nvme/libnvme'
     steps:
       - name: Check if it is a release tag
@@ -59,15 +65,14 @@ jobs:
            if [[ ${{ github.event.ref }} =~ ^refs/tags/v([0-9]+\.[0-9]+)(\.[0-9]+)?(-rc[0-9]+)?$ ]]; then
                echo ::set-output name=match::true
            fi
+
       - name: Download artifiact
         uses: actions/download-artifact@v4
         if: steps.check-tag.outputs.match == 'true'
         with:
           name: artifact
           path: dist
+
       - name: Publish package to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1.12
+        uses: pypa/gh-action-pypi-publish@v1.12.4
         if: steps.check-tag.outputs.match == 'true'
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}