IT-6150: switch PyPI publishing to trusted publishing (OIDC)

[jychuah]

Part of IT-6150 — move PyPI release uploads to GitHub Actions OIDC trusted publishing, removing the long-lived PYPI_USERNAME / PYPI_PASSWORD token from repo secrets.

What changed (.github/workflows/publish-on-pypi.yml)

• Added permissions: id-token: write (required for OIDC).
• Added environment: pypi (must match the Environment field in the PyPI trusted-publisher config).
• Replaced the twine upload step — which used secrets.PYPI_USERNAME / secrets.PYPI_PASSWORD — with pypa/gh-action-pypi-publish (pinned to v1.14.1).
• Kept twine check --strict as its own step.

⚠️ DO NOT MERGE YET — ordering matters

This workflow only authenticates after a trusted publisher is configured on the PyPI project. Because this PR removes the token auth, merging it before PyPI is configured will break the next release.

Required order:

1. IT configures the trusted publisher on PyPI: owner enthought, this repository, workflow filename publish-on-pypi.yml, environment pypi.
2. Cut a validation release / re-run the workflow and confirm the OIDC upload succeeds.
3. Then merge this PR.

Kept as a draft until step 1 is done. /cc @mdickinson

[mdickinson]

Workflow change looks fine to me. Has the trusted publishing already been set up on the PyPI side?

[mdickinson]

I've set up trusted publishing on the PyPI side, and added the appropriate environment here.

Test run: https://github.com/enthought/apptools/actions/runs/30286226427

That test run should fail as a result of the release already existing, but every step up to that should pass.

[mdickinson]

That test run should fail as a result of the release already existing, but every step up to that should pass.

Verified: the test run failed with:

400 File already exists ('apptools-5.3.1-py3-none-any.whl',   
         with blake2_256 hash                                                   
         'bcdb3318162c4e74deeaa3c23564104f8c46fcbedf600190fd40bcf1f8b73b7c'

And it's clear from the log that pypa/gh-action-pypi-publish is being used, so I definitely tested with the version of the workflow from this branch, not from main.

[Copilot]

Pull request overview

Updates the PyPI publishing workflow to use GitHub Actions OIDC “trusted publishing” instead of long-lived PyPI credentials, aligning releases with modern tokenless authentication.

Changes:

• Add job environment: pypi and request id-token: write for OIDC.
• Replace twine upload (username/password secrets) with pypa/gh-action-pypi-publish pinned to a commit.
• Keep twine check --strict as a separate validation step.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mdickinson]

Merging. Thanks, @jychuah!