PyPI only stores PEP 740 attestations, and shows provenance, when the
upload uses Trusted Publishing. Drop the PYPI_API_TOKEN password and
run the job in a pypi environment that the trusted publisher names.

Co-authored-by: Xianpeng Shen <[email protected]>

…693)

…ce (#692)

* refactor: save a git call when the author is on ignore_authors

The author checks asked git whether a commit exists before they read
ignore_authors, so an author on the list cost one `git rev-parse` more
than in 2.20.4. Read the list first again, and look the commit up only
when the list said no; a repository with no commits then asks the list
a second time about the identity the first commit will carry.

One test of the fallback to the last commit's author ran that lookup
against the real repository. It now patches it like the other git calls.

* test: pass has_head instead of patching the commit lookup

Patching has_commits in the fallback test built a mock that costs more
than the git call it replaced, by CodSpeed's count. The test now tells
_get_author_value that a commit exists, so nothing is looked up.

---------

Co-authored-by: Xianpeng Shen <[email protected]>