Enhance release workflow: add environment and permissions for Trusted Publishing

Signed-off-by: kmilo <kmilo.denis.glez@yandex.com>

Author: kmilodenisglez

.github/workflows/release.yml

@@ -1,5 +1,8 @@
 name: Release
 
+# IMPORTANT: PyPI validates against the filename (release.yml),
+# the owner, and the repo registered in the Trusted Publisher. If you change
+# the filename, update the registration on pypi.org.
 on:
   push:
     tags:
@@ -14,7 +17,9 @@ jobs:
   release:
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    environment: pypi          # Must exist in GitHub AND be registered in PyPI
     permissions:
+      id-token: write          # OIDC: mandatory for Trusted Publishing
       contents: read
 
     steps:
@@ -36,11 +41,10 @@ jobs:
       - name: Build distribution
         run: python -m build --sdist --wheel
 
-      # Recommended future improvement: migrate to Trusted Publishing (OIDC).
-      # Requires: permissions: id-token: write, remove 'password',
-      # and configure the publisher on pypi.org.
+      # Trusted Publishing: no password required. The action obtains an ephemeral
+      # OIDC token signed by GitHub, which PyPI validates against the
+      # registered publisher. There are no secrets to rotate or leak.
       - name: Publish to PyPI
         if: startsWith(github.ref, 'refs/tags/')
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
+        # attestations: true   # optional: generate PEP 740 attestations (supply chain)