Pin pypa/gh-action-pypi-publish@release/v1

.github/workflows/pypi.yml

@@ -50,6 +50,6 @@ jobs:
 
     - name: Upload to PyPI
       if: (github.ref == 'refs/heads/master') && inputs.upload
-      uses: pypa/gh-action-pypi-publish@master
+      uses: pypa/gh-action-pypi-publish@release/v1
       with:
         password: ${{ secrets.PYPI_TOKEN }}