feat: Use PyPI trusted publishing

Stainless-Generated-From: ef334cf435298ff75e9a59a5e453eb0bf9647e11

Author: kernel-internal[bot]

.github/workflows/publish-pypi.yml

@@ -12,6 +12,12 @@ jobs:
   publish:
     name: publish
     runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/hypeman
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -24,8 +30,8 @@ jobs:
           RYE_VERSION: '0.44.0'
           RYE_INSTALL_OPTION: '--yes'
 
+      - name: Build distributions
+        run: rye build --clean
+
       - name: Publish to PyPI
-        run: |
-          bash ./bin/publish-pypi
-        env:
-          PYPI_TOKEN: ${{ secrets.HYPEMAN_PYPI_TOKEN || secrets.PYPI_TOKEN }}
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

.github/workflows/release-doctor.yml

@@ -18,5 +18,5 @@ jobs:
         run: |
           bash ./bin/check-release-environment
         env:
-          RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
-          PYPI_TOKEN: ${{ secrets.HYPEMAN_PYPI_TOKEN || secrets.PYPI_TOKEN }}
+          ADMIN_APP_ID: ${{ secrets.ADMIN_APP_ID }}
+          ADMIN_APP_PRIVATE_KEY: ${{ secrets.ADMIN_APP_PRIVATE_KEY }}

CONTRIBUTING.md

@@ -113,9 +113,4 @@ the changes aren't made through the automated pipeline, you may want to make rel
 
 ### Publish with a GitHub workflow
 
-You can release to package managers by using [the `Publish PyPI` GitHub action](https://www.github.com/kernel/hypeman-python/actions/workflows/publish-pypi.yml). This requires a setup organization or repository secret to be set up.
-
-### Publish manually
-
-If you need to manually release a package, you can run the `bin/publish-pypi` script with a `PYPI_TOKEN` set on
-the environment.
+Use the [`Publish PyPI` GitHub workflow](https://www.github.com/kernel/hypeman-python/actions/workflows/publish-pypi.yml) to publish or retry a release. It authenticates through PyPI Trusted Publishing and the `pypi` GitHub environment; no API token is required.

bin/check-release-environment

@@ -2,12 +2,12 @@
 
 errors=()
 
-if [ -z "${RELEASE_PLEASE_TOKEN}" ]; then
-  errors+=("The RELEASE_PLEASE_TOKEN secret has not been set. Create a fine-grained GitHub PAT and add it as a repository secret.")
+if [ -z "${ADMIN_APP_ID}" ]; then
+  errors+=("The ADMIN_APP_ID secret has not been set.")
 fi
 
-if [ -z "${PYPI_TOKEN}" ]; then
-  errors+=("The PYPI_TOKEN secret has not been set. Please set it in either this repository's secrets or your organization secrets.")
+if [ -z "${ADMIN_APP_PRIVATE_KEY}" ]; then
+  errors+=("The ADMIN_APP_PRIVATE_KEY secret has not been set.")
 fi
 
 lenErrors=${#errors[@]}