Publish to PyPI with trusted publishing

[anth-volk]

Fixes # (no tracking issue exists yet. A maintainer should create or link one, per docs/engineering/skills/github-prs.md.)

Same-Repository Draft PR Check

• This PR is a draft.
• This PR is from a branch in PolicyEngine/policyengine-sim-api, not a personal fork.

Summary

• Moves the upload in .github/workflows/publish-clients.yml (policyengine-api-simulation-client) from the shared org-wide secrets.PYPI token to PyPI trusted publishing (OIDC).
• Job publish:
  • Added environment: pypi. The pypi environment already exists in this repo, limited to main.
  • Added a job-level permissions: block with contents: read and id-token: write. The job only checks out, generates and builds the client, and uploads.
  • Removed password: ${{ secrets.PYPI }}. The action ignores OIDC while a password is passed. packages-dir is kept.
• That was the only secrets.PYPI use in .github. Nothing else changes: the trigger, the if: gate, and the date-based version 0.<YYYYMMDD>.<run_number>.

When the first trusted publish happens

• This workflow runs on workflow_run after Deploy Simulation API completes successfully for a push event. Every successful run gets a new version, so no version or changelog bump is needed.
• workflow_run runs always use the workflow file from the default branch and run with GITHUB_REF set to main. So this change takes effect only after merge, and the pypi environment's main-only branch policy is satisfied.
• Deploy Simulation API (simulation-deploy.yml) runs on every push to main with no path filters. So merging this PR, like any merge, starts the normal beta → prod deployment. If that deploy succeeds, this workflow publishes the first client release via trusted publishing. If it fails, the first trusted publish happens after the next successful deploy. This PR adds nothing whose purpose is to force a deploy.

Before merging

Add a trusted publisher on PyPI for the policyengine-api-simulation-client project (Manage → Publishing):

Field	Value
Owner	PolicyEngine
Repository	policyengine-sim-api
Workflow filename	publish-clients.yml
Environment	pypi

If this PR is merged before the publisher is added, the client upload after the next successful deploy fails with invalid-publisher. Re-run Publish API clients after adding the publisher.

Testing

• actionlint -shellcheck= on publish-clients.yml: clean before and after.
• No application code changes, so unit and integration tests are unaffected. PR CI covers them as usual.
• After merge and the next successful production deploy: Publish API clients uploads 0.<YYYYMMDD>.<run_number> via trusted publishing.

🤖 Generated with Claude Code