Email from PyPI reading: " A Trusted Publisher for project truststore was just used from a CI/CD job configured with a GitHub environment. The environment used was: Deploy. Since the Trusted Publisher is configured to allow any environment, for security reasons we recommend constraining it to only one. If you are an owner of this project, you can automatically constrain this Trusted Publisher to 'Deploy' by following this link: constrain publisher. Alternatively, you can do this manually by going to the project's publishing settings, deleting the existing Trusted Publisher and creating a new one with the environment set to 'Deploy'."
https://cdn.fosstodon.org/media_attachments/files/113/964/136/120/094/229/original/1e2d242ccb646a2c.png