[Copilot]

The deploy job built the package but failed at uv publish. PyPI returned 403 because username/password authentication is no longer supported.

This moves python-publish.yml to PyPI Trusted Publishing, which authenticates with GitHub OIDC and needs no stored credentials.

• Auth
  • Dropped UV_PUBLISH_USERNAME and UV_PUBLISH_PASSWORD (the PMH_PYPI_USER and PMH_PYPI_PASS secrets).
  • The publish step is now uv publish --trusted-publishing always. always makes the job fail if OIDC isn't available, rather than falling back to credentials.
• Permissions
  • Added job-level id-token: write (needed to mint the OIDC token) alongside contents: read.
  • Added environment: pypi to the job.

deploy:
  runs-on: ubuntu-latest
  environment: pypi
  permissions:
    contents: read
    id-token: write
  ...
  - name: Publish
    run: uv publish --trusted-publishing always

Needs doing before the next release:

• Add a trusted publisher for probscale on pypi.org with these values:
  • repository: matplotlib/mpl-probscale
  • workflow: python-publish.yml
  • environment: pypi
• The pypi environment name is my choice. Either use it on PyPI and create the environment in the repo settings, or remove the environment: line and leave that field blank on PyPI. If the two don't match, the publish will fail.
• The workflow only triggers on release creation, so this change hasn't been exercised yet. The first release after setup is the real test.
• Once publishing works, the two old secrets can be deleted from the repo.