ci: enable trusted publishing for PyPI

[Copilot]

Long-lived PyPI tokens are a supply-chain risk; OIDC-based trusted publishing eliminates them by issuing short-lived credentials scoped to a specific workflow run.

Changes

• New workflow .github/workflows/publish.yml
  • Triggers on release: published
  • build job: installs Poetry, runs poetry build, uploads dist/ as a workflow artifact
  • publish job: downloads artifact, publishes via pypa/gh-action-pypi-publish using OIDC — no token required
  • Top-level permissions: contents: read; publish job scoped to id-token: write only

Required admin steps (not in this PR)

1. PyPI → zodipy project → Publishing → add pending publisher:
   • Repo: Cosmoglobe/zodipy, workflow: publish.yml, environment: pypi
2. GitHub → Settings → Environments → create environment named pypi (add approval gates as desired)

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to publish the package to PyPI using OIDC “trusted publishing” on GitHub Releases, avoiding long-lived PyPI tokens.

Changes:

• Introduces publish.yml triggered on release.published.
• Builds the package with Poetry and transfers dist/ via workflow artifacts.
• Publishes to PyPI via pypa/gh-action-pypi-publish using OIDC with an environment gate.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The workflow-level permissions restricts the GITHUB_TOKEN to contents: read only, which is likely insufficient for actions/upload-artifact / actions/download-artifact (these generally require actions: write/actions: read). Consider either adding the required actions permission at the workflow level, or (more tightly) setting per-job permissions: build job gets actions: write (+ contents: read for checkout) and publish job gets actions: read (+ id-token: write).

[neutrinoceros]

its even better to use permissions: {} at the top level and only add specific permissions at the job level

[neutrinoceros]

(I also don't think this specific permission is needed at all here)

[MetinSa]

Thanks for the comments! I let copilot have a go at it before I check it out myself. Do you have a repo with a good setup that you recommend me checking out?

[neutrinoceros]

Yup. Have a go at neutrinoceros/idefix_cli. It's as simple as they come (but note I don't use poetry).