ci(pypi): publish from a top-level job so trusted publishing can match

[dpezto]

Why

PyPI matches a registered trusted publisher against the job_workflow_ref OIDC claim — the workflow file containing the publishing job. workflow_ref sits in warehouse's __unchecked_claims__ and is never validated.

With the publish running inside package-pypi.yml, a workflow_call-only reusable workflow, that claim named the reusable file rather than release.yml. PyPI does not accept a reusable workflow as a publisher, per its own troubleshooting page and warehouse#11096. That is what returned invalid-publisher: valid token, but no corresponding publisher on the 3.0.0 release — and no value entered in the publisher form could have matched it, including the release.yml the error's workflow_ref field invites.

What moved

Only the publish job. Building is untouched.

Job	Where	Change
build_sdist	package-pypi.yml	none
build_wheels (6 runners)	package-pypi.yml	none
publish	release.yml as pypi-publish	hoisted

The build jobs still upload dist-sources and dist-wheels-<os>. Artifacts are scoped to the workflow run, so the hoisted job downloads them across the call boundary with the same pattern: dist-* and merge-multiple: true as before.

The hoisted job declares environment: pypi and permissions: id-token: write, and states the release_created gate explicitly rather than relying on skip-propagation from the pypi job, so the condition survives an edit there. The pypi reusable call correspondingly drops id-token: write, which it no longer needs.

Removed inputs

package-name and environment-name are removed along with the job that read them. An environment-name input that no longer selects the deployment environment would be a silent no-op on a security boundary — worse than its absence. Both values now live explicitly in release.yml.

PYPI_API_TOKEN stays declared but inert in the reusable workflow. The rollback to classic token auth is the same secret, now consumed by release.yml's pypi-publish job.

npm and crates are unchanged

Neither job is touched by this diff. npm's OIDC works from inside its reusable workflow: it reached Rekor and was rejected for duplicate content, which is a different failure from publisher matching, and needs no structural change.

Registration this expects

A pending publisher, since the project does not yet exist on PyPI:

Field	Value
PyPI Project Name	tree-sitter-gnuplot
Owner	dpezto
Repository name	tree-sitter-gnuplot
Workflow name	release.yml
Environment name	pypi

The environment must be pypi and not blank, matching the job's own environment: declaration — a mismatch in either direction reproduces invalid-publisher.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!