fix(ci): read dist secrets from the pypi environment

Docker, Homebrew notify, and AUR publish already store credentials as
environment secrets on `pypi`; wire environment: pypi so jobs can see them.

Author: ulises-jeremias

.github/workflows/notify-homebrew.yml

@@ -20,6 +20,7 @@ jobs:
   notify:
     name: Dispatch to homebrew-tap
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - name: Resolve version
         id: version

.github/workflows/publish-aur.yml

@@ -20,6 +20,7 @@ jobs:
   aur:
     name: Update AUR package
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - name: Resolve version
         id: version

.github/workflows/publish-docker.yml

@@ -20,6 +20,7 @@ jobs:
   docker:
     name: Build and push Docker image
     runs-on: ubuntu-latest
+    environment: pypi
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

docs/DISTRIBUTION_SETUP.md

@@ -9,7 +9,9 @@
 | **AUR** | `publish-aur.yml` | `AUR_SSH_PRIVATE_KEY`, `AUR_REPO_TOKEN` |
 | **Homebrew** | `notify-homebrew.yml` → `homebrew-tap` | `HOMEBREW_TAP_TOKEN` |
 
-Configure secrets under **Settings → Secrets and variables → Actions**.
+Configure secrets under **Settings → Environments → `pypi` → Environment secrets**
+(not repository Action secrets). Release, Docker, AUR, and Homebrew jobs all use
+`environment: pypi`.
 
 ## PyPI Trusted Publishing