Trusted publishing exchange failure: OpenID Connect token retrieval failed: GitHub: missing or insufficient OIDC token permissions, the ACTIONS_ID_TOKEN_REQUEST_TOKEN environment variable was unset The workflow context indicates that this action was called from a pull request on a fork. GitHub doesn't give these workflows OIDC permissions, even if `id-token: write` is explicitly configured. To fix this, change your publishing workflow to use an event that forks of your repository cannot trigger (such as tag or release creation, or a manually triggered workflow dispatch).

While cibuildwheel can build CPython 3.8 universal2/arm64 wheels, we cannot test the arm64 part of them, even when running on an Apple Silicon machine. This is because we use the x86_64 installer of CPython 3.8. See the discussion in https://github.com/pypa/cibuildwheel/pull/1169 for the details. To silence this warning, set `CIBW_TEST_SKIP: "cp38-macosx_*:arm64"`.