Add trusted-publish

Committed via https://github.com/asottile/all-repos

.github/workflows/check.yml

@@ -1,7 +1,7 @@
 name: check
 on:
   push:
-  pull_request:
+    tags-ignore: ["**"]  pull_request:
   schedule:
     - cron: "0 8 * * *"