[anth-volk]

Summary

Moves the PyPI upload in .github/workflows/versioning.yaml from the shared org-wide PYPI API token to PyPI trusted publishing (OIDC), and adds a patch changelog entry so merging this PR cuts a release through the new path.

Changes to the publish-to-pypi job:

• environment: pypi. The pypi environment already exists in this repo, limited to main, so only runs on main can get a token PyPI will accept.
• The job already had permissions: contents: write + id-token: write. No change needed.
• Removed user: __token__ and password: ${{ secrets.PYPI }} from pypa/gh-action-pypi-publish. The action ignores OIDC while a password is passed. skip-existing: true stays.

There are no other secrets.PYPI uses in .github/.

Release: changelog.d/trusted-publishing.changed.md. .github/bump_version.py maps changed fragments to a patch bump (only breaking is major, and only added/removed are minor), so merging bumps 1.5.11 to 1.5.12. I checked this by running infer_bump from the script on the branch (it returns patch) and towncrier build --draft.

Note: changelog.d/ on main already has two leftover .yaml files (fix-copy-performance.yaml, migrate-to-app-token.yaml). towncrier doesn't use them, and the bump script counts them as patch, so they don't change the bump. I left them alone.

Before merging

Add a trusted publisher to the PyPI project microdf-python (Manage, then Publishing):

Field	Value
Owner	PolicyEngine
Repository	microdf
Workflow filename	versioning.yaml
Environment	pypi

If this merges before the publisher exists, the upload fails with invalid-publisher. Add the publisher, then re-run the failed Publish to PyPI job. skip-existing makes the re-run safe.

Test plan

• actionlint on the changed workflow: no findings, same as before the change
• Checked that the changelog entry maps to a patch bump with the repo's own bump tooling
• PR checks pass
• After the PyPI publisher is added and this merges: the Update package version run's Publish to PyPI job uploads the new patch version using OIDC, and the version shows up on PyPI

🤖 Generated with Claude Code