[Code scan] Limit PyPI OIDC permission to tag publish jobs

[njzjz]

This issue is a result of a Codex global code scan of deepmodeling/deepmodeling_sphinx at commit 156679f.

Problem

The PyPI release workflow runs on all pushes and pull requests, grants id-token: write to the whole job, and only gates the final publishing step on tag pushes. The build steps do not need PyPI trusted-publishing OIDC permission.

Code references:

deepmodeling_sphinx/.github/workflows/release.yml

Lines 1 to 9 in 156679f

	on: [push, pull_request]
	name: Release to pypi
	jobs:
	release-to-pypi:
	name: Release to pypi
	runs-on: ubuntu-latest
	permissions:
	# IMPORTANT: this permission is mandatory for trusted publishing
	id-token: write

deepmodeling_sphinx/.github/workflows/release.yml

Lines 17 to 24 in 156679f

	- name: Install dependencies
	run: python -m pip install build
	- run: python -m build
	- name: Publish a Python distribution to PyPI
	if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
	uses: pypa/gh-action-pypi-publish@release/v1
	with:
	verbose: true

Impact

OIDC token minting is available during non-publish job runs. The final PyPI upload is guarded, but least privilege would keep publish credentials unavailable to branch and pull-request builds.

Suggested fix

Split build/test from publish, or add a tag-only job-level condition for the publishing job. Keep id-token: write only on the publish job, and set the remaining permissions explicitly, for example contents: read for checkout.