From 0d2940c14eeba4befe76b26e71f1409ddc80891d Mon Sep 17 00:00:00 2001
From: Kimmo Huoman <kipenroskaposti@gmail.com>
Date: Tue, 16 Jun 2026 14:41:18 +0300
Subject: [PATCH] Switch PyPI publish to trusted publishing

- Add pypi environment and OIDC id-token permission
- Replace uv publish with gh-action-pypi-publish
- Remove PYPI_USERNAME/PYPI_PASSWORD secrets

Migrates package publishing from long-lived PyPI credentials
to GitHub OIDC trusted publishing for better security.
---
 .github/workflows/python-publish.yml | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index e087847..7ccae2b 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -7,6 +7,9 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -19,9 +22,7 @@ jobs:
         with:
           python-version: "3.x"
       - name: Build and publish
-        env:
-          UV_PUBLISH_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          UV_PUBLISH_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
         run: |
           uv build
-          uv publish
+      - name: Upload to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1