From 717d940e3c136db363dabbf4c2e79ce1589f9ec0 Mon Sep 17 00:00:00 2001
From: Tony Narlock <tony@git-pull.com>
Date: Sun, 7 Dec 2025 15:12:12 -0600
Subject: [PATCH 1/3] ci(release): Migrate to PyPI Trusted Publisher

why: Improve security by eliminating stored API tokens and enable package attestations
what:
- Add OIDC permissions (id-token, attestations) to release job
- Remove user/password authentication in favor of trusted publishing
- Enable attestations for supply chain security
- Fix deprecated skip_existing to skip-existing
---
 .github/workflows/tests.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 0287083..ce637b0 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -57,6 +57,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    permissions:
+      id-token: write
+      attestations: write
 
     strategy:
       matrix:
@@ -80,6 +83,5 @@ jobs:
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
-          skip_existing: true
+          attestations: true
+          skip-existing: true

From e32de41c4b6cbca29660fd6a81dac419add74154 Mon Sep 17 00:00:00 2001
From: Tony Narlock <tony@git-pull.com>
Date: Sun, 7 Dec 2025 15:12:36 -0600
Subject: [PATCH 2/3] docs(CHANGES): Document Trusted Publisher migration
 (#410)

---
 CHANGES | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/CHANGES b/CHANGES
index 6e139d1..16a4bef 100644
--- a/CHANGES
+++ b/CHANGES
@@ -37,6 +37,10 @@ $ uvx --from 'django-slugify-processor' --prerelease allow django-slugify-proces
 - _Add your latest changes from PRs here_
 <!-- END PLACEHOLDER - ADD NEW CHANGELOG ENTRIES BELOW THIS LINE -->
 
+### CI
+
+- Migrate to PyPI Trusted Publisher (#410)
+
 ### Documentation
 
 - Visual improvements to API docs from [gp-sphinx](https://gp-sphinx.git-pull.com)-based Sphinx packages (#417)

From 516e487fc98482ee1c320099fb0ceaca72fabaef Mon Sep 17 00:00:00 2001
From: Tony Narlock <tony@git-pull.com>
Date: Sun, 7 Dec 2025 16:31:13 -0600
Subject: [PATCH 3/3] ai(rules[AGENTS]): Clarify namespace imports for stdlib
 only

---
 AGENTS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AGENTS.md b/AGENTS.md
index dc617e6..0297050 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -148,7 +148,7 @@ def test_custom_processor(settings):
 
 ### Imports
 
-- Prefer namespace imports (e.g., `import typing as t`), avoiding `from module import *`
+- Prefer namespace imports for stdlib (e.g., `import typing as t`); third-party packages may use `from X import Y`
 - Include `from __future__ import annotations` at the top of Python files
 
 ### Docstrings