Enhancement: automate PyPI releases via GitHub Actions with Trusted Publishing

[stumpylog]

Hi, and thanks for maintaining imap_tools - it's a dependency we rely on in https://github.com/paperless-ngx/paperless-ngx.

I noticed from the packaging notes that releases currently use a manual twine upload flow backed by a .pypirc credential. I wanted to suggest migrating to https://docs.pypi.org/trusted-publishers/, which replaces the stored credential with a short-lived OIDC token scoped to a specific GitHub Actions workflow.

The motivation: recent supply chain incidents - such as the https://docs.litellm.ai/blog/security-update-march-2026 - have shown that a leaked PyPI token is sufficient for an attacker to push a malicious release. Trusted Publishing removes that risk entirely, with no long-lived secret to protect or rotate.

The practical change for you would be:

• Build and upload steps move to a GitHub Actions workflow triggered on tag push
• The .pypirc credential goes away
• You'd do a one-time Trusted Publisher configuration in the PyPI project settings UI

I'm happy to open a PR with the GitHub Actions workflow - the only step that would remain on your end is the one-time PyPI settings change. Let me know if that would be welcome.

[ikvk]

@stumpylog , thanks for your attention to lib.
I'll look into this matter. I can't promise a quick response.

[stumpylog]

Happy to help on the work if you'd like