Publish to PyPI with trusted publishing

.github/workflows/versioning.yaml

@@ -47,6 +47,12 @@ jobs:
       name: Publish to PyPI
       if: (github.event.head_commit.message == 'Update package version')
       runs-on: ubuntu-latest
+      # PyPI trusted publishing: uploads accepted only from this workflow in
+      # the pypi environment (limited to main). No stored token.
+      environment: pypi
+      permissions:
+        contents: write # publish-git-tag.sh pushes the release tag
+        id-token: write # OIDC token for PyPI trusted publishing
       steps:
         - name: Checkout code
           uses: actions/checkout@v6
@@ -56,15 +62,15 @@ jobs:
           uses: actions/setup-python@v6
           with:
             python-version: 3.13
-        - name: Install package
-          run: make install
+        # Building the wheel needs only the build tool. The dev extras pin
+        # policyengine-us==1.667.1, which is no longer on PyPI.
+        - name: Install build tool
+          run: pip install build
         - name: Build package
           run: python -m build
         - name: Publish a git tag
           run: ".github/publish-git-tag.sh || true"
         - name: Publish to PyPI
           uses: pypa/gh-action-pypi-publish@release/v1
           with:
-            user: __token__
-            password: ${{ secrets.PYPI }}
             skip-existing: true

changelog_entry.yaml

@@ -0,0 +1,4 @@
+- bump: patch
+  changes:
+    changed:
+    - Publish to PyPI with trusted publishing (OIDC) instead of a stored API token.