release.yml: switch upload auth to OIDC trusted publishing (id-token: write)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: awesomebytes

.github/workflows/release.yml

@@ -4,23 +4,21 @@ name: Release
 # artifact installs and runs from a channel with no repo checkout, then upload
 # it to the prefix.dev channel.
 #
-# ┌─────────────────────────────────────────────────────────────────────────┐
-# │ MANUAL SETUP REQUIRED before the first release will succeed:              │
-# │   1. Create the prefix.dev channel `awesomebytes`:                        │
-# │        https://prefix.dev/channels/awesomebytes                           │
-# │      (rename here and in README if you pick a different channel name).    │
-# │   2. Add a repository secret PREFIX_API_KEY — a prefix.dev API token with │
-# │      write access to that channel (Settings → Secrets and variables →     │
-# │      Actions → New repository secret).                                    │
-# │ Until both exist the build + artifact-test steps still run; only the      │
-# │ upload step fails.                                                        │
-# └─────────────────────────────────────────────────────────────────────────┘
+# Authentication: OIDC trusted publishing (no API token stored anywhere).
+# prefix.dev → channel `awesomebytes` → Repository Access authorizes
+# awesomebytes/rclcppyy, workflow release.yml, with read/write. The
+# `id-token: write` permission below lets the job mint the GitHub OIDC token
+# that rattler-build exchanges automatically during `upload prefix`.
 
 on:
   push:
     tags:
       - 'v*'
 
+permissions:
+  contents: read
+  id-token: write
+
 concurrency:
   group: release-${{ github.ref }}
   cancel-in-progress: false
@@ -87,9 +85,7 @@ jobs:
           cd "$workdir"
           pixi run python smoke.py
 
-      - name: Upload to the prefix.dev channel `awesomebytes`
-        env:
-          PREFIX_API_KEY: ${{ secrets.PREFIX_API_KEY }}
+      - name: Upload to the prefix.dev channel `awesomebytes` (OIDC)
         run: |
           set -euxo pipefail
           pixi run -e pkg rattler-build upload prefix --channel awesomebytes \