[anth-volk]

Summary

Moves the PyPI upload in .github/workflows/versioning.yaml from the shared org-wide PYPI API token to PyPI trusted publishing (OIDC), and adds a patch changelog entry so merging this PR cuts a release through the new path.

Changes to the publish-to-pypi job:

• environment: pypi. The pypi environment already exists in this repo, limited to main, so only runs on main can get a token PyPI will accept.
• permissions: with contents: write (the job pushes the release tag via .github/publish-git-tag.sh, and job-level permissions replace the defaults) and id-token: write (needed to mint the OIDC token).
• Removed user: __token__ and password: ${{ secrets.PYPI }} from pypa/gh-action-pypi-publish. The action ignores OIDC while a password is passed. skip-existing: true stays.

There are no other secrets.PYPI uses in .github/.

Release: changelog_entry.yaml with bump: patch. make changelog (yaml-changelog build-changelog + bump-version) turns this into 0.5.3 to 0.5.4. I checked this by running those commands on a copy of the branch files, which printed Bumping from 0.5.3 to 0.5.4.

Already broken, not fixed here: .github/publish-git-tag.sh calls .github/fetch_version.py, which this repo doesn't have. So the Publish a git tag step fails quietly (|| true), and no version tags have been pushed. This doesn't affect the PyPI upload, so I left it out of this PR.

Publish job no longer installs the dev extras

The [dev] extras pin policyengine-us==1.667.1, which has been removed from PyPI. The publish job ran make install (pip install -e ".[dev]"), so it would fail before uploading. It now installs only build, which is all python -m build needs; a clean local build produces the wheel and sdist without the dev extras.

The PR's Build and Test checks still fail for the same reason. That failure is already on main (CI has failed since 2026-04-28) and needs the test pin updated, which is left for a follow-up because newer policyengine-us versions may change test results.

Before merging

Add a trusted publisher to the PyPI project policyengine-data (Manage, then Publishing):

Field	Value
Owner	PolicyEngine
Repository	policyengine-data
Workflow filename	versioning.yaml
Environment	pypi

If this merges before the publisher exists, the upload fails with invalid-publisher. Add the publisher, then re-run the failed Publish to PyPI job. skip-existing makes the re-run safe.

Test plan

• actionlint on the changed workflow: no findings, same as before the change
• Checked that the changelog entry maps to a patch bump with the repo's own bump tooling
• PR checks pass
• After the PyPI publisher is added and this merges: the Update package version run's Publish to PyPI job uploads the new patch version using OIDC, and the version shows up on PyPI

🤖 Generated with Claude Code

[anth-volk]

Closing without merging. policyengine-data is being retired instead of moved to PyPI trusted publishing: nothing in the PolicyEngine organization imports the package, and its dev extras pin policyengine-us==1.667.1, which is no longer on PyPI. The repository is being archived, and the PyPI project will be archived separately by a PyPI owner. This follows the same approach as reweight (PolicyEngine/reweight#23).