Publish to PyPI with trusted publishing

[anth-volk]

Summary

Moves the PyPI upload in .github/workflows/versioning.yaml from the shared org-wide PYPI API token to PyPI trusted publishing (OIDC), and adds a patch changelog entry so merging this PR cuts a release through the new path.

Changes to the publish-to-pypi job:

• environment: pypi. The pypi environment already exists in this repo, limited to main, so only runs on main can get a token PyPI will accept.
• permissions: with contents: write (the job pushes the release tag via .github/publish-git-tag.sh, and job-level permissions replace the defaults) and id-token: write (needed to mint the OIDC token).
• Removed user: __token__ and password: ${{ secrets.PYPI }} from pypa/gh-action-pypi-publish. The action ignores OIDC while a password is passed. skip-existing: true stays.

There are no other secrets.PYPI uses in .github/.

Release: changelog.d/trusted-publishing.changed.md. .github/bump_version.py maps changed fragments to a patch bump (only breaking is major, and only added/removed are minor), so merging bumps 3.1.3 to 3.1.4. I checked this by running infer_bump from the script on the branch (it returns patch) and towncrier build --draft. The Changelog PR check (towncrier check --compare-with origin/main) accepts the fragment.

Before merging

Add a trusted publisher to the PyPI project microimpute (Manage, then Publishing):

Field	Value
Owner	PolicyEngine
Repository	microimpute
Workflow filename	versioning.yaml
Environment	pypi

If this merges before the publisher exists, the upload fails with invalid-publisher. Add the publisher, then re-run the failed Publish to PyPI job. skip-existing makes the re-run safe.

Test plan

• actionlint on the changed workflow: no findings, same as before the change
• Checked that the changelog entry maps to a patch bump with the repo's own bump tooling
• PR checks pass
• After the PyPI publisher is added and this merges: the Update package version run's Publish to PyPI job uploads the new patch version using OIDC, and the version shows up on PyPI

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
microimpute-dashboard	Ready	Preview	Oct 12, 2026 1:34pm UTC