ci: trusted publishing for PyPI releases

[rennf93]

Removes workflow_dispatch from release.yml (a master dispatch must never be able to reach a publish job, tornadoapi-guard PR #23 precedent) and replaces the twine + TWINE_USERNAME/TWINE_PASSWORD path with PyPI trusted publishing (pypa/gh-action-pypi-publish, id-token: write, pypi environment, release published trigger aligned with guard-core).

Note for the maintainer: the PyPI project settings must list this repo, workflow release.yml, and environment pypi as the trusted publisher. Once merged and verified on the next release, the now-unreferenced TWINE_USERNAME/TWINE_PASSWORD secrets can be deleted.

Summary by CodeRabbit

• Release Publishing
  • Publishing now runs only when a release is published; creation and manual triggers are no longer supported.
  • PyPI publishing uses a dedicated publishing action and environment. The release tag is no longer written to the VERSION file.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 67117fca-8840-40e6-9494-032e3a3f00bb

📥 Commits

Reviewing files that changed from the base of the PR and between 33c9499 and 8daf4a5.

📒 Files selected for processing (1)

• .github/workflows/release.yml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The release workflow now runs only for published releases. It enables the pypi environment and uses the PyPI publishing action instead of Twine.

Changes

Release Publishing

Layer / File(s)	Summary
Release trigger and package publishing .github/workflows/release.yml	The workflow now triggers on published releases, enables the pypi environment, and publishes through pypa/gh-action-pypi-publish@release/v1. It no longer supports manual dispatch, installs Twine, or writes the release tag to VERSION.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 8daf4

The identified version mismatch predates this change; no remaining issue blocks merging the trusted-publishing workflow after normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to 8daf4

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/release.yml: The release trigger now matches published instead of created, and the manual workflow_dispatch trigger was removed. The pypi environment is enabled instead of remaining commented out.
• observed — Modified behavior in .github/workflows/release.yml: Dependency installation no longer includes twine. The publishing step replaces a Twine upload using TWINE_USERNAME and TWINE_PASSWORD with pypa/gh-action-pypi-publish@release/v1; it also no longer writes the release tag to VERSION.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: replacing credential-based PyPI publishing with trusted publishing in CI.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[rennf93]

Closing per maintainer direction: the existing release path works and the baseline stays as-is.