From 3656d410ed68fa2652c01bc2f4419a8a83dce287 Mon Sep 17 00:00:00 2001
From: David Ford <david@blue-labs.org>
Date: Wed, 16 Sep 2026 22:27:17 -0400
Subject: [PATCH 1/2] ci: add production PyPI trusted publishing

Tag-triggered OIDC upload via the pypi environment, matching the
TestPyPI workflow so 2.1.0+ can publish without a long-lived token.

Signed-off-by: David Ford <david@blue-labs.org>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/publish.yml | 48 +++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 .github/workflows/publish.yml

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..aabfa19
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,48 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Poetry
+        run: pipx install poetry==2.4.1
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Build
+        run: poetry build
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+
+  publish-pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

From 6028ba571edb5cb0fa00a013affba3779eeea397 Mon Sep 17 00:00:00 2001
From: David Ford <david@blue-labs.org>
Date: Wed, 16 Sep 2026 22:27:17 -0400
Subject: [PATCH 2/2] documentation: mark 2.1.0 as the current release

Move Latest off 2.0.2, date the 2.1.0 notes, and record the PyPI
trusted-publishing workflow.

Signed-off-by: David Ford <david@blue-labs.org>
Co-authored-by: Cursor <cursoragent@cursor.com>
---
 ChangeLog.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/ChangeLog.md b/ChangeLog.md
index b5be1ca..43b172f 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,6 +1,8 @@
 # ChangeLog
 
-## 2.1.0
+## 2.1.0 Latest
+September 16, 2026
+
   - switch to poetry
   - merge outstanding PRs
   - make handle checks and make them more robust
@@ -14,8 +16,9 @@
   - document when to use `resetcreds=True` vs `False` (#52)
   - bump pip to 26.2.1 (CVE-2026-13346 / GHSA-qwm4-qh6w-59xr)
   - refresh tox, pylint, mypy, pytest-env, and pip-tools pins
+  - add GitHub Actions trusted publishing for PyPI
 
-## 2.0.2 Latest
+## 2.0.2
 March 17, 2022
 
 ### Surface fixes