twine: --trusted-publishing never + env-var diagnostic, v0.1.5

Pipeline #40358 (v0.1.4) failed with the same OIDC error as 0.1.0:

  TrustedPublishingFailure: Unable to retrieve an OIDC token from
  the CI platform for trusted publishing GitLab: Environment
  variable PYPI_ID_TOKEN not found

Twine 6's default is --trusted-publishing automatic, which ALWAYS
tries OIDC first when it detects GitLab CI env vars, regardless of
whether TWINE_USERNAME/TWINE_PASSWORD are set. Adding
'--trusted-publishing never' forces classic API token auth via env
vars (or .pypirc) and skips the OIDC dance entirely.

Plus a sanity-check that the group-scoped TWINE_USERNAME and
TWINE_PASSWORD vars actually landed in the env on this pipeline
('set' or 'MISSING' — never echoes the value). If they're MISSING
despite being configured at the python/ group level, the most likely
cause is the vars being marked Protected while the tag isn't a
protected ref (Settings -> Repository -> Protected tags).

.gitlab-ci.yml

@@ -40,10 +40,18 @@ pypi-twine:
   only:
     - tags
   script:
+    # Sanity-check that the group-scoped CI vars actually landed in the
+    # env on this pipeline. Prints "set" or "MISSING" — never the value,
+    # never echoes them anywhere — so masked/protected flags stay safe.
+    - 'test -n "${TWINE_USERNAME:-}" && echo "TWINE_USERNAME: set" || echo "TWINE_USERNAME: MISSING (check group vars Protected flag vs tag protection)"'
+    - 'test -n "${TWINE_PASSWORD:-}" && echo "TWINE_PASSWORD: set" || echo "TWINE_PASSWORD: MISSING (check group vars Protected flag vs tag protection)"'
     - python3 -m venv .venv
     - . .venv/bin/activate
     - pip install --upgrade pip
     - pip install build twine
     - python -m build
     - twine check dist/*
-    - twine upload --non-interactive dist/*
+    # --trusted-publishing never: twine 6 defaults to attempting OIDC
+    # when it detects GitLab CI, even if TWINE_USERNAME/TWINE_PASSWORD
+    # are set. Explicitly disable OIDC so it uses the env vars directly.
+    - twine upload --non-interactive --trusted-publishing never dist/*

erldistpy/__init__.py

@@ -1,6 +1,6 @@
 """erldistpy — native Python client for our Erlang distribution protocol."""
 
-__version__ = "0.1.4"
+__version__ = "0.1.5"
 
 from erldistpy.channel import Channel, ChannelError, IncomingMessage
 from erldistpy.epmd import EpmdError, EpmdInfo, lookup

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "erldistpy"
-version = "0.1.4"
+version = "0.1.5"
 description = "Native Python client for Erlang distribution protocol — EPMD + v6 handshake + gen_server call(), no asyncio."
 readme = { file = "README.md", content-type = "text/markdown" }
 requires-python = ">=3.10"