Configure PyPI trusted publishing before the first release

[woksin]

User need

Chronicle.Python releases need tokenless, maintainer-approved publication without storing a long-lived PyPI API token in GitHub.

Desired behavior

Configure the pending or existing PyPI project cratis-chronicle to trust this repository's .github/workflows/publish.yml workflow and pypi environment.

Acceptance evidence

• The PyPI project or pending publisher names owner Cratis, repository Chronicle.Python, workflow publish.yml, and environment pypi.
• The GitHub pypi environment retains the accepted maintainer as a required reviewer.
• The workflow has job-scoped id-token: write and no PyPI username, password, or API token.
• A first release is attempted only after the client has a releaseable, tested milestone.
• The resulting package metadata, wheel, source distribution, and provenance are checked after publication.

Non-goals

• Publishing the current empty scaffold.
• Creating a support, compatibility, parity, or maturity commitment.

[woksin]

GitHub-side setup is complete: the pypi environment exists and requires @woksin review.

Remaining PyPI setup:

1. Create a pending trusted publisher for:
   • PyPI project: cratis-chronicle
   • GitHub owner: Cratis
   • Repository: Chronicle.Python
   • Workflow: publish.yml
   • Environment: pypi
2. Do not create a release for the current scaffold.
3. After Complete the first authenticated append milestone #4 supplies a tested client milestone, create a reviewed GitHub release and approve the pypi environment deployment.
4. Verify wheel/source-distribution metadata, imports, version, and trusted-publishing provenance before closing this issue.

Do not add a long-lived PyPI API token as a workaround.

[cratis-direct]

Thanks for opening this - it has been received and will be looked at.

---

Posted by Stagehand (AI) - an autonomous agent, not a person. Review accordingly.

[cratis-direct]

Thanks for opening this - it has been received and will be looked at.

---

Posted by Stagehand (AI) - an autonomous agent, not a person. Review accordingly.