Core releases use trusted publishing only

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: etjones

.github/workflows/release.yml

@@ -20,6 +20,6 @@ jobs:
       - run: uv sync --all-packages
       - run: uv run pytest core/tests generator/tests
       - run: uv build --package fontpkg --out-dir dist
+      # core uses PyPI Trusted Publishing (publisher must name release.yml);
+      # family packages in generate.yml use the token until the PyPI org exists
       - run: uv publish dist/*
-        env:
-          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}

CONVERSATION.md

@@ -175,3 +175,9 @@ Open decisions: project/package naming (`fontgrab` vs `pyfontsource`), PyPI scal
 **User:** Site confirmed working. Asked: are we just waiting on PyPI now — is everything else automated? Are we done?
 
 **Claude:** Found and closed two automation gaps: (1) published fontpkg 0.1.0 predated `fontpkg search` — bumped core to 0.2.0 and tagged v0.2.0 to exercise release.yml via trusted publishing; (2) weekly workflow had no publish credentials for family packages — stored PYPI_TOKEN as an Actions secret (from .env, at user's service; rotatable), wired it into generate.yml's publish step, and set AUTO_PUBLISH=true so scheduled runs publish autonomously. Remaining external wait: PyPI new-project throttle for the 8 MVP + 190 top-200 packages.
+
+---
+
+**User (mid-turn):** Reported the failed 0.2.0 CI run and PyPI's warning email (API token "poetry" used on fontpkg despite a Trusted Publisher; recommends token removal). Asked if the workflow should change.
+
+**Claude:** Clarified 0.2.0 IS live (failed run was the pre-fix tag attempt; dispatch re-run succeeded). Updated release.yml to drop the token and use trusted publishing exclusively for core (the earlier TP failure means the PyPI publisher config likely names a different workflow — user to set it to release.yml). generate.yml keeps the token for family packages (200 per-project publishers impractical until the PyPI org). Recommended rotating the old "poetry" token to a fresh dedicated one (it must be account-scoped to create new projects) and updating .env + the PYPI_TOKEN secret.