From 9b1aa2e2a11e68d2ef1d100ba6ece643f26c4500 Mon Sep 17 00:00:00 2001
From: Jeff Kala <jeff.l.kala@gmail.com>
Date: Mon, 10 Aug 2026 15:22:14 -0600
Subject: [PATCH] testing trusted publisher with no environment key usage

---
 .github/workflows/release.yml           | 10 +++-------
 changes/+trusted-publisher.housekeeping |  1 +
 2 files changed, 4 insertions(+), 7 deletions(-)
 create mode 100644 changes/+trusted-publisher.housekeeping

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e31b6a74..c3a92c4f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,8 +55,9 @@ jobs:
     runs-on: "ubuntu-latest"
     if: "startsWith(github.ref, 'refs/tags/v')"
     needs: "build"
-    environment: "pypi"
-    # Steps to publish to PyPI.
+    # IMPORTANT: this permission is mandatory for trusted publishing.
+    permissions:
+      id-token: "write"
     steps:
       - name: "Retrieve built package from cache"
         uses: "actions/download-artifact@v4"
@@ -65,11 +66,6 @@ jobs:
           path: "dist/"
       - name: "Publish package distributions to PyPI"
         uses: "pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e"  # v1.13.0
-        ## Used for networktocode org since trusted publisher isn't supported for GitHub Plan.
-        with:
-          user: "__token__"
-          password: "${{ secrets.PYPI_API_TOKEN }}"
-        # End publish to PyPI job.
 
   slack-notify:
     needs:
diff --git a/changes/+trusted-publisher.housekeeping b/changes/+trusted-publisher.housekeeping
new file mode 100644
index 00000000..a35d4edf
--- /dev/null
+++ b/changes/+trusted-publisher.housekeeping
@@ -0,0 +1 @@
+Work on trusted publisher for networktocode org.