ci: add production PyPI trusted publishing

.github/workflows/publish.yml

@@ -0,0 +1,48 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Poetry
+        run: pipx install poetry==2.4.1
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Build
+        run: poetry build
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+
+  publish-pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

ChangeLog.md

@@ -1,6 +1,8 @@
 # ChangeLog
 
-## 2.1.0
+## 2.1.0 Latest
+September 16, 2026
+
   - switch to poetry
   - merge outstanding PRs
   - make handle checks and make them more robust
@@ -14,8 +16,9 @@
   - document when to use `resetcreds=True` vs `False` (#52)
   - bump pip to 26.2.1 (CVE-2026-13346 / GHSA-qwm4-qh6w-59xr)
   - refresh tox, pylint, mypy, pytest-env, and pip-tools pins
+  - add GitHub Actions trusted publishing for PyPI
 
-## 2.0.2 Latest
+## 2.0.2
 March 17, 2022
 
 ### Surface fixes