Merge pull request #117 from Create-Python-App/fix/58-pypi-oidc

ci: PyPI Trusted Publishing OIDC job (#58)

Author: ulises-jeremias

.github/workflows/publish.yml

@@ -32,4 +32,6 @@ jobs:
           files: dist/*
       - name: Publish to PyPI (OIDC)
         if: startsWith(github.ref, 'refs/tags/')
-        run: echo "PyPI trusted publishing wired in #58 — placeholder job"
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

docs/DISTRIBUTION_SETUP.md

@@ -8,3 +8,10 @@ Secrets and publishers (see also #58–#63):
 | Docker Hub | `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN` |
 | AUR | `AUR_SSH_PRIVATE_KEY`, `AUR_REPO_TOKEN` |
 | Homebrew | `HOMEBREW_TAP_TOKEN` |
+
+## PyPI Trusted Publishing
+
+1. Create a Trusted Publisher on PyPI for `create-awesome-python-app`
+2. Repository: `Create-Python-App/create-python-app`
+3. Workflow: `publish.yml`
+4. No `PYPI_TOKEN` secret required when using OIDC