From 049666b061371e5d472f42895b4c6b676fa1e420 Mon Sep 17 00:00:00 2001
From: "russell@unturf.com" <russell@unturf.com>
Date: Tue, 16 Jun 2026 14:54:53 -0400
Subject: [PATCH] switch to Trusted Publishing OIDC, drop twine/setuptools
 pins, v0.1.4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pending publisher registered on PyPI for python/erldistpy with
workflow filepath .gitlab-ci.yml — GitLab now mints a short-lived
OIDC ID token (audience=pypi) per pipeline, twine 6+ exchanges it
for a scoped upload token. No long-lived secret on the runner.

What this commit changes:
  - .gitlab-ci.yml pypi-twine stage gains id_tokens: PYPI_ID_TOKEN
  - pip install twine (no <6 pin) — twine 6 is OIDC-native
  - pyproject.toml build-system requires drops the setuptools<77 cap
    (latest setuptools emits Metadata-Version 2.4 which twine 6 reads
    fine; locally verified)

After this tag publishes successfully, the same pattern goes to:
  - ago (python/ago)
  - make-post-sell (engineering/make-post-sell)
  - remarkbox (engineering/remarkbox)
each gets a Trusted Publisher entry added on the PyPI project page,
then the id_tokens block lands in their CI.

Recipe lives at docs/PYPI-TRUSTED-PUBLISHING.md (updated to reflect
the new auth model is now live for erldistpy).
---
 .gitlab-ci.yml        | 14 +++++++-------
 erldistpy/__init__.py |  2 +-
 pyproject.toml        |  9 ++-------
 3 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index f691d1c..7b7439f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -35,17 +35,17 @@ pypi-twine:
   tags: ["build"]
   only:
     - tags
+  # GitLab mints a short-lived OIDC ID token (audience=pypi) and injects
+  # it as PYPI_ID_TOKEN. Twine v6+ auto-detects it and exchanges it with
+  # PyPI for a scoped upload token. No long-lived secret on the runner.
+  id_tokens:
+    PYPI_ID_TOKEN:
+      aud: pypi
   script:
     - python3 -m venv .venv
     - . .venv/bin/activate
     - pip install --upgrade pip
-    # Pin twine <6 — newer twine auto-detects GitLab CI and refuses to
-    # fall back to ~/.pypirc on the runner, requiring PYPI_ID_TOKEN
-    # (Trusted Publishing OIDC) instead. Until we migrate all four
-    # python/* repos to Trusted Publishing in one coordinated change,
-    # stick with the classic ~/.pypirc path that ago / make_post_sell /
-    # remarkbox already use.
-    - pip install build "twine<6"
+    - pip install build twine
     - python -m build
     - twine check dist/*
     - twine upload --non-interactive dist/*
diff --git a/erldistpy/__init__.py b/erldistpy/__init__.py
index 355d2df..01bb76c 100644
--- a/erldistpy/__init__.py
+++ b/erldistpy/__init__.py
@@ -1,6 +1,6 @@
 """erldistpy — native Python client for our Erlang distribution protocol."""
 
-__version__ = "0.1.3"
+__version__ = "0.1.4"
 
 from erldistpy.channel import Channel, ChannelError, IncomingMessage
 from erldistpy.epmd import EpmdError, EpmdInfo, lookup
diff --git a/pyproject.toml b/pyproject.toml
index 0dbe692..2f198d2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,15 +1,10 @@
 [build-system]
-# setuptools 77+ emits Metadata-Version 2.4 (PEP 639 license-expression).
-# twine <6 caps at metadata 2.3 and rejects 2.4 wheels with "Metadata is
-# missing required fields: Name, Version." Until we migrate the build
-# runner to Trusted Publishing OIDC (which lets us use twine 6+), keep
-# setuptools below 77 so the wheel stays metadata 2.3.
-requires = ["setuptools>=68,<77", "wheel"]
+requires = ["setuptools>=68", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "erldistpy"
-version = "0.1.3"
+version = "0.1.4"
 description = "Native Python client for Erlang distribution protocol — EPMD + v6 handshake + gen_server call(), no asyncio."
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.10"