GeezerVison

Why

The v2.20.4 release page on PyPI says No provenance. publish.yml already uses pypa/gh-action-pypi-publish, but it uploads with password: ${{ secrets.PYPI_API_TOKEN }}. PyPI only accepts and shows PEP 740 attestations when the upload uses Trusted Publishing (OIDC). With a token the action skips them.

Change

• PyPI step: drop the password: line, so the action uses the job's existing id-token: write (Trusted Publishing) and uploads attestations by default.
• Job runs in a pypi environment (url: https://pypi.org/p/commit-check), matching the trusted publisher on PyPI.
• TestPyPI dry run (workflow_dispatch) is unchanged and still uses TEST_PYPI_TOKEN.
• actions/attest-build-provenance stays; it feeds gh attestation verify, which is separate from PyPI's provenance.

Before vs after

Needed before merging

Add a trusted publisher at https://pypi.org/manage/project/commit-check/settings/publishing/ with owner commit-check, repository commit-check, workflow publish.yml, environment pypi. Without it the next release fails at the upload step. After one good release, delete the PYPI_API_TOKEN secret and revoke the token on PyPI.