[pypi] Switch to PyPI Trusted Publishing

[FindHao]

Summary

This PR migrates the PyPI publishing workflow from API token authentication to Trusted Publishing (OIDC).

Changes

• Added id-token: write permission for OIDC token generation
• Removed user and password parameters from the publish step
• Enabled attestations: true for package provenance

Why

Trusted Publishing provides:

• No secrets to manage: Eliminates the need for API tokens stored in GitHub Secrets
• Better security: Uses short-lived OIDC tokens instead of long-lived API tokens
• Attestations support: Enables cryptographic proof of package provenance

Required Setup

Before merging, configure Trusted Publisher on PyPI:

1. Go to https://pypi.org/manage/project/tritonparse/settings/publishing/
2. Add a new publisher with:
   • Owner: meta-pytorch
   • Repository: tritonparse
   • Workflow name: nightly-pypi.yml
   • Environment: (leave empty)

References

• PyPI Trusted Publishers Documentation
• GitHub Actions Publishing Guide

[meta-codesync]

@FindHao has imported this pull request. If you are a Meta employee, you can view this in D89004848.

[Copilot]

Pull request overview

This PR modernizes the PyPI publishing workflow by migrating from legacy API token authentication to PyPI Trusted Publishing using OIDC, eliminating the need for long-lived secrets while improving security through short-lived tokens and cryptographic attestations.

Key Changes:

• Switched authentication method from API tokens to OIDC-based Trusted Publishing
• Added id-token: write permission for OIDC token generation
• Enabled cryptographic attestations for package provenance verification

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[meta-codesync]

@FindHao merged this pull request in 88b8ed6.