Migrate publish workflow to OIDC trusted publishing

[MrTravisB]

Summary

Migrates the publish workflow from API token authentication to OIDC trusted publishing for both PyPI and TestPyPI.

Changes

• Added id-token: write and contents: read permissions at both workflow and job levels
• Replaced twine upload commands with pypa/gh-action-pypi-publish@release/v1 action
• Removed dependency on TEST_PYPI_API_TOKEN and PYPI_API_TOKEN secrets
• Maintained existing package verification steps for TestPyPI

Benefits

• More secure: Uses short-lived OIDC tokens instead of long-lived API tokens
• No token management: No secrets to rotate or secure
• Better auditability: PyPI can verify which workflow published each version
• Simpler maintenance: Fewer secrets to manage in repository settings

Configuration Required

Before merging, trusted publishers must be configured on both platforms:

TestPyPI

https://test.pypi.org/manage/account/publishing/

• Owner: Mozilla-Ocho
• Repository: tabstack-python
• Workflow: publish.yml
• Environment: (leave blank)

PyPI

https://pypi.org/manage/account/publishing/

• Same configuration as TestPyPI

🤖 Generated with Claude Code