We've been recommending that building or anything else that doesn't need elevated OIDC privileges should be confined to separate GHA jobs with lower privileges. Build first, use artifacts to share the dists with the publishing job.

• https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
• https://docs.pypi.org/trusted-publishers/security-model/