[andife]

Description

Migrates PyPI publishing from a long-lived API token (secrets.PYPI_PASSWORD) to PyPI Trusted Publishing (OIDC):

• The Publish to PyPI step no longer passes user/password; pypa/gh-action-pypi-publish authenticates with a short-lived OIDC token minted per workflow run.
• The pypi job is granted id-token: write and bound to a pypi deployment environment (with the project URL), so environment protection rules (required reviewers, tag restrictions) can be applied.
• As a side benefit, gh-action-pypi-publish automatically generates and uploads PEP 740 attestations when using Trusted Publishing.

This eliminates the risk of the long-lived PyPI token being exfiltrated from repository secrets.

⚠️ Required maintainer actions before the next release:

1. On pypi.org → Markdown project → Publishing, add a GitHub trusted publisher: owner Python-Markdown, repository markdown, workflow deploy.yml, environment pypi.
2. Create the pypi environment under repository Settings → Environments (optionally restrict it to tags / require reviewers).
3. After the first successful OIDC-based release, delete the PYPI_PASSWORD secret and revoke the token on PyPI.

Note: this PR is stacked on top of the general supply-chain hardening PR (action SHA pinning + least-privilege permissions); its own change is the last commit only.

Validation: the workflow file was checked with a YAML parser (yaml.safe_load) — parses successfully. The publish path can only be fully exercised on the next tagged release after the PyPI trusted publisher is configured.

AI Assistance Disclosure

• No AI tools were used in preparing this PR.

• AI tools were used and I have disclosed which ones, and have fully reviewed and verified their output.

  AI tools were use to assist with the following:

  • Code
  • Code Comments
  • Documentation
  • Changelog Entry
  • Commit Message
  • The Description Above
  • Other: GitHub Copilot CLI (workflow/CI configuration changes)

Checklist

• This PR follows the contribution guidelines.
• The code follows the Code Style Guide.
• The commit message follows the Commit Message Style Guide.
• I have added or updated relevant docs, including release notes if applicable which follow the Documentation Style Guide. (Not applicable: CI-configuration-only change; required maintainer steps are documented above.)
• I have added or updated relevant tests. (Not applicable: no Python code changed; workflow validated via YAML parsing.)
• I have not requested, and will not request, an automated AI review for this PR.

[waylan]

There is an open issue for this at #1560. I have not made this change because the existing implementation works (if it an't broke, don't fix it). Therefore, this will likely continue to sit here until such time as GitHub changes something which forces this change to be made.