ci(release): Migrate to PyPI Trusted Publisher

.github/workflows/tests.yml

@@ -51,6 +51,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
+    permissions:
+      id-token: write
+      attestations: write
 
     strategy:
       matrix:
@@ -74,6 +77,5 @@ jobs:
       - name: Publish package
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
-          skip_existing: true
+          attestations: true
+          skip-existing: true

AGENTS.md

@@ -171,7 +171,7 @@ def test_rst_tag_renders_toc_only(settings):
 ## Coding Standards
 
 - Always include `from __future__ import annotations` at the top of Python files
-- Prefer namespace imports (`import typing as t`; `import enum`) over `from module import ...`
+- Prefer namespace imports for stdlib (`import typing as t`; `import enum`); third-party packages may use `from X import Y`
 - Follow NumPy-style docstrings for functions and methods
 - Ruff enforces formatting; use `ruff format` before committing
 - Type hints are required; keep mypy strictness in mind and add `TypedDict`/`Protocol` as needed

CHANGES

@@ -33,6 +33,10 @@ $ uvx --from 'django-docutils' --prerelease allow django-docutils
 _Upcoming changes will be written here._
 <!-- END PLACEHOLDER - ADD NEW CHANGELOG ENTRIES BELOW THIS LINE -->
 
+### CI
+
+- Migrate to PyPI Trusted Publisher (#447)
+
 ### Documentation
 
 - Visual improvements to API docs from [gp-sphinx](https://gp-sphinx.git-pull.com)-based Sphinx packages (#453)