Use PyPI trusted publishing via GitHub actions

[AndrewSazonov]

We use PyPI Trusted Publishing for publishing Python packages from GitHub CI.

Trusted Publishing uses OpenID Connect (OIDC) and allows PyPI to trust GitHub Actions directly. This means:

• no personal API tokens
• no long-lived secrets

⚠️ Every project developer needs to complete the following steps:

Configuration Steps

1. Go to https://pypi.org and log in
2. Open Your account → Publishing (left sidebar)
3. Under Add a new publisher:
   Select GitHub Actions and fill in:
   • Organization: easyscience
   • Repository: library repository name (e.g. peasy-lib, diffraction-lib, etc.)
   • Workflow name: pypi-publish.yml
   • Environment name: Leave empty
4. Click Add

Consequences

After this is configured, the pypi-publish.yml workflow (added to the repository via the Copier templates) will automatically publish the package to PyPI whenever a new GitHub release is created.

---

Links to the original discussions: #52