ruv cc153e8b56 ci(adr-184): migrate pip-release publish to PyPI OIDC Trusted Publishing ...

Drop all four PYPI_API_TOKEN password inputs from the publish-v2 and
publish-tombstone jobs, grant id-token: write, and bind both jobs to the
pypi GitHub environment so pypa/gh-action-pypi-publish uses secretless
Trusted Publishing. Rewrite the header + add step comments documenting
the blocking manual pypi.org trusted-publisher registration (ADR-184
§3.1) and the token fallback (§3.2). Build matrix untouched.

Refs ADR-184 P1.

2026-07-21 16:07:11 -07:00

..

workflows

ci(adr-184): migrate pip-release publish to PyPI OIDC Trusted Publishing

2026-07-21 16:07:11 -07:00

dependabot.yml

security: pin GitHub Actions to SHAs and bump vulnerable npm deps (#442)

2026-04-28 08:46:51 -04:00