[pedrohcgs]

The automatic 1.1.7 upload reached PyPI but failed with HTTP 403 while using the existing username/password secrets. This replaces that authentication with PyPI Trusted Publishing (OIDC), scoped to this repository's pypi_upload.yml workflow and pypi environment.

The publisher keeps the four trusted successful main-push checks and exact tested SHA. It builds without OIDC permission, passes immutable current-run artifacts to a separate publish job, and rechecks CI/main immediately before upload. A main-only manual retry cannot bypass those checks. All releases share one concurrency group.

Before skipping or resuming existing files, it verifies their PyPI digests, wheel/source identities, runtime source, dependency/build metadata, and wheel installation fields. A changed source under an existing version, unsafe archive or yanked file fails clearly; matching partial uploads can finish. Documentation and archive timestamp changes do not require a new release.

Validation: 401 tests plus 92 subtests pass, including all 379 estimator tests and 22 release-gate tests. Actionlint, Python 3.8 syntax, isolated wheel/sdist builds, metadata checks, live read-only exact-SHA GitHub checks and live PyPI preflights pass. All eight runtime Python files are unchanged.

One-time registry configuration must authorize this identity before activation:

Field	Value
PyPI project	drdid
GitHub owner	d2cml-ai
Repository	DRDIDpy
Workflow filename	pypi_upload.yml
GitHub environment	pypi

The GitHub environment is restricted to main and has no per-release reviewer or timer. The four main CI checks remain mandatory with no bypass actors. No estimator, version, dependency pin or numerical tolerance changes. See docs/publishing.md for setup and operational details.

Activation verified: merged as 60b24662e17867eb0ae8a12c0f3ba010639e3e4d; all four main CI checks passed. The exact Trusted Publisher was registered after owner approval. Automatic publisher run published DRDID 1.1.7 without a dispatch or rerun. Both public artifacts pass SHA256, all eight runtime-source files, build-input and metadata verification against merged main and reviewed backend 53a6b76.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.