[sbrunner]

Summary

Replace the c2cciutils-publish publication, which relied on the abandoned camptocamp/initialise-gopass-summon-action, with tag-publish running in a dedicated job whose dependencies are fully locked.

Context

• camptocamp/initialise-gopass-summon-action is abandoned in favour of GitHub OpenId Connect.
• The gopass store was reorganised on 29.10.2026 (gs/ci/dockerhub to gs/projects/dockerhub, gs/ci/transifex to gs/projects/transifex), so the patterns used by this workflow no longer resolve.
• Related: C2CSEC-185

Implementation Details

• .github/publish.yaml declares the PyPI publication (version_tag and version_branch). The equivalent section is removed from ci/config.yaml, which is deleted as it held nothing else.
• .github/publish/ is a uv project pinning tag-publish[pypi]==1.3.2 with a committed uv.lock, kept up to date by the uv-lock hook of sbrunner/hooks.
• The new publish job runs after build, is gated on its success output, and only asks for contents: read and id-token: write.
• build no longer publishes, it only exports the success output. The gopass step is dropped and ci/requirements.txt loses the [publish] extra.
• Workflow level permissions: contents: read, actions pinned by commit hash, pip installs restricted to --only-binary=:all:.
• docs.yaml gets the same treatment, plus the explicit contents: write it needs to push the GitHub Pages branch.

Testing & Validation

• A PyPI trusted publisher must be declared for the camptocamp/python-geoservercloud repository, workflow main.yaml, without environment.
• The publish job publishes nothing on pull requests, tag-publish only acts on the declared version types.

Impact/Risks

• The PYPI_PASSWORD credentials coming from the gopass store are no longer used.
• Until the trusted publisher is configured, the publication triggered by a push on master fails with an authentication error.
• No change for the consumers of the geoservercloud package.