fix: publish to PyPI with the token

[antonwhop]

Why

The 1.0.11 release (#59) built cleanly and failed at the upload:

workflow_ref: whopio/whopsdk-python/.github/workflows/publish-main.yml@refs/heads/main
environment: MISSING
See https://docs.pypi.org/trusted-publishers/troubleshooting/

Trusted publishing was never configured on the PyPI project, so no publisher matched the OIDC claims. The repo already has a PYPI_TOKEN secret — the same one the old Stainless bin/publish-pypi used — so use it.

Nothing was published and no tag was created: tag re-checked PyPI, saw 1.0.11 absent, and declined. main is at 1.0.11 with PyPI still on 0.0.41.

What changed

• The publish step authenticates with password: ${{ secrets.PYPI_TOKEN }}.
• Dropped id-token: write — nothing needs it now.
• Added a preflight that fails immediately with a clear message if the secret is missing, instead of after a full build and upload attempt.

The token stays confined to the publish job, which installs nothing and only uploads the artifact build produced. That separation is the reason a token here is acceptable: no third-party code runs in the same job.

After merging

Merging this does not re-trigger the release — it touches a workflow file, not pyproject.toml. Dispatch Release from main to publish 1.0.11; decide re-reads the version, sees it absent from PyPI, and proceeds.

Worth doing later: trusted publishing removes the long-lived credential entirely and is what the TypeScript SDK uses. Configuring it on the PyPI project (owner whopio, repo whopsdk-python, workflow publish-main.yml, environment blank) would let this revert to OIDC and the PYPI_TOKEN secret be deleted.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XV1533iUUxKJxfn4FXptWz