[anth-volk]

Warning

This would not work if pushed to main today. The Publish job is skipped on every push (its commit-message gate can no longer be met), and make install fails because setup.py pins policyengine-us==1.667.1, which is no longer on PyPI. Both are explained below; this PR stays a draft until they are resolved.

Summary

Moves PyPI publishing from the shared org-wide secrets.PYPI token to PyPI trusted publishing (OIDC), and bumps the version for a patch release.

• .github/workflows/push.yaml, Publish job:
  • added environment: pypi
  • added job-level permissions: { contents: write, id-token: write }. contents: write is needed because .github/publish-git-tag.sh pushes the version tag; id-token: write lets the action mint the OIDC token.
  • removed user: __token__ and password: ${{ secrets.PYPI }} from pypa/gh-action-pypi-publish (the action ignores OIDC while a password is passed). skip-existing: true is kept.
• setup.py: version 0.3.0 -> 0.3.1. PyPI's latest is 0.3.0. Since the versioning job was removed in ac40d1d, the repo bumps the version by hand in setup.py.

The pypi GitHub environment already exists in this repo, limited to the main branch. No repo settings, environments or secrets are changed by this PR.

⚠️ Merging this PR will NOT publish 0.3.1 by itself

There are two existing problems on main. I left both alone because fixing them needs decisions beyond this migration:

1. The Publish job never runs. Publish, Lint and Test in push.yaml only run when github.event.head_commit.message == 'Update reweight'. That commit used to come from the versioning job, which was removed in ac40d1d ("Removed versioning", July 2024). Since then, no push to main triggers Publish. The last push run (Update GitHub Actions for Node 24 runtime #22, 2026-04-28) was skipped. The 0.3.0 upload (2024-08-14) did not come from this workflow.
2. make install cannot resolve. setup.py pins policyengine-us==1.667.1, and that version is no longer on PyPI. The job also uses Python 3.9, while current policyengine-core/policyengine-uk need >=3.11. Resolving locally on 3.9 gives: there is no version of policyengine-us==1.667.1. The PR Test job only appears green because it has continue-on-error: true. Publishing 0.3.1 with that pin would also give users a package they can't install.

To actually release, a maintainer needs to decide how to:

• remove or replace the commit-message gate on Publish, for example by gating on github.repository only
• update the policyengine-us pin and the Python version, or drop the unneeded make install step from Publish

Either fix can go in this PR or in a follow-up.

Before merging

Add a trusted publisher on PyPI for the project reweight (Manage project -> Publishing):

Field	Value
Owner	PolicyEngine
Repository	reweight
Workflow filename	push.yaml
Environment	pypi

If the Publish job runs before the publisher is added, the upload step fails with invalid-publisher. Adding the publisher and re-running the failed job fixes it.

Test plan

• actionlint on push.yaml: no findings
• Confirmed policyengine-us==1.667.1 is missing from PyPI (uv pip install --dry-run -e .[dev] on Python 3.9 fails)
• PR checks (Lint, Test) pass
• Add the PyPI trusted publisher above
• Resolve the two blockers above, then confirm the Publish job on main uploads reweight 0.3.1

🤖 Generated with Claude Code