[tleonhardt]

Summary

PyPI only accepts PEP 740 attestations (provenance) on files uploaded by a Trusted Publisher running in CI. A local upload with an API token can't carry them, so this moves the upload into GitHub Actions.

• New .github/workflows/publish.yml, started by hand on a release tag:
  • The build job checks the tag with scripts/validate_tag.py, runs uv build, and uploads
    dist/ as an artifact. It has read-only permissions and no uv cache.
  • The publish job downloads dist/ and uploads it with pypa/gh-action-pypi-publish, which
    signs and uploads the attestations by default. It runs in the pypi or testpypi environment,
    and it's the only job that can request an OIDC token.
  • Every action is pinned to a commit SHA, since this is the workflow that can publish.
• make publish / make publish-test still check the tag first. They then confirm the tag on
  origin matches the local one, start the workflow with gh workflow run, and follow it with
  gh run watch --exit-status. The release checklist doesn't change.
• uv-publish is removed from the dev dependency group because nothing uses it anymore.
• .github/CONTRIBUTING.md documents the new flow and the one-time setup.

Already configured outside this PR

• Trusted Publishers on PyPI and TestPyPI for publish.yml with environments pypi / testpypi
• GitHub environments pypi and testpypi:
  • deployments only from tags matching *.*.*
  • cmd2-admins required as reviewers, with administrator bypass turned off
• Repository ruleset "Release tags": only cmd2-admins can create, move, or delete *.*.* tags

Testing

• make check, make test, and make docs-test pass
• zizmor reports no findings for publish.yml
• I ran both make targets with a fake gh to check the normal run, a missing run URL, a failed
  run, and a tag that isn't on origin
• The workflow itself can only run after this merges. The first real check is make publish-test
  on the next release tag.

Notes

• 4.4.0 can't get provenance after the fact: PyPI only accepts attestations as part of the
  original upload, and uploaded files can't be changed.
• The workflow has to be on main before the next release is tagged, because gh runs the copy
  of publish.yml inside the tagged commit.
• No CHANGELOG entry, since this only changes release tooling.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.75%. Comparing base (8d20b7b) to head (ce7ffff).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1802   +/-   ##
=======================================
  Coverage   99.75%   99.75%           
=======================================
  Files          23       23           
  Lines        6593     6593           
=======================================
  Hits         6577     6577           
  Misses         16       16           

Flag	Coverage Δ
unittests	99.75% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.