I updated most of my #pypi project to use "trusted publisher"
I can't figure out how to get an "environment" to only allow deployment from tags (which bizarrely #github treats as "branches") so I instead add an approver step and potentially all builds can be deployments, but only if I click OK.
Completely invisible...