Use trusted publishing for PyPI releases - #193

Summary

• preserve the existing push-button process for updating versions and changelogs and creating a tagged GitHub release
• move release preparation into a separate manually dispatched workflow
• dispatch the PyPI publishing workflow at the newly created release tag
• verify that the tag matches setup.py, redfish.__version__ and CHANGELOG.md
• separate the unprivileged build job from the PyPI publishing job
• require explicit approval through the protected pypi GitHub environment
• replace the long-lived PyPI API token with OIDC Trusted Publishing
• publish PyPI attestations and pin all third-party actions to immutable commits
• document the revised maintainer release process

Motivation

The current release workflow updates the version and changelog, pushes those changes, creates the GitHub release, builds the package and publishes it with a stored PYPI_API_TOKEN. Although the workflow is public, packages published this way do not include PyPI provenance attestations.

This change keeps the existing push-button release preparation. The manually dispatched workflow still accepts the version and changelog entries, updates the release metadata, pushes the changes to main and creates the tagged GitHub release.

PyPI publication is handled separately. After creating the release, the preparation workflow dispatches main.yml at the new tag. The publishing workflow verifies that it is running from a published release tag, checks the package and changelog versions, builds the distributions without publishing credentials and transfers only those distributions to the publishing job.

The publishing job waits for approval through the protected pypi GitHub environment. Once approved, it authenticates to PyPI using a short-lived OIDC credential and uploads provenance attestations with the distributions.

This was prompted by the dependency-transparency review for the downstream Home Assistant Redfish integration.

Closes #194.

Maintainer setup required

Before the first release using this workflow:

1. Create a pypi environment in this GitHub repository and configure at least one required reviewer.
2. On the PyPI redfish project, confirm that the GitHub Trusted Publisher is configured with:
   • owner: DMTF
   • repository: python-redfish-library
   • workflow: main.yml
   • environment: pypi
3. After the first trusted publication succeeds, remove the unused PYPI_API_TOKEN repository secret.

This draft should not be marked ready until the protected GitHub environment and PyPI Trusted Publisher have both been confirmed.

Validation

• actionlint with ShellCheck for both workflows: passed
• pedantic zizmor audit for both workflows: no findings
• release metadata update simulation: passed
• invalid versions, multiline changelog entries and duplicate versions: rejected as expected
• mixed line endings in the existing version files: preserved
• source distribution and wheel build: passed
• twine check for both distributions: passed
• Python 3.14 tests: 63 tests and 35 subtests passed
• DCO: passed

No GitHub release or PyPI publication was triggered during validation.

The existing tox -e pep8 target continues to report pre-existing formatting errors in files untouched by this change.