release: switch to OIDC trusted publishing (no token, nothing to rotate)

GitHub Actions mints a short-lived identity token the registry verifies
against a trusted publisher configured once. Removes the API-token secret
and its 90-day expiry entirely.

Author: MattJackson

.github/workflows/release.yml

@@ -5,9 +5,19 @@ on:
     tags:
       - "v*"
 
+# Publishing uses PyPI OIDC "trusted publishing": GitHub Actions mints a short-lived
+# identity token that PyPI verifies against a trusted publisher you configure once —
+# no API token, no secret, nothing that expires or needs rotating.
+#
+# One-time setup (owner: GetBusbar, repo: busbar-python, workflow: release.yml,
+# environment: leave blank) at:
+#   https://pypi.org/manage/project/busbar-admin/settings/publishing/
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write   # required for OIDC trusted publishing
+      contents: read
     steps:
       - uses: actions/checkout@v4
 
@@ -29,18 +39,5 @@ jobs:
       - name: Build sdist + wheel
         run: python -m build
 
-      # Publish is gated on the PyPI token secret. Without it, the build above
-      # still runs and the job succeeds without publishing.
-      - name: Publish to PyPI
-        if: ${{ env.PYPI_API_TOKEN != '' }}
-        env:
-          PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
+      - name: Publish to PyPI (OIDC trusted publishing — no token)
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
-
-      - name: Note when token is absent
-        if: ${{ env.PYPI_API_TOKEN == '' }}
-        env:
-          PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
-        run: echo "::notice::PYPI_API_TOKEN not set — built artifacts but skipped publish."