ci: publish to PyPI via Trusted Publishing, drop the RC scheme

.github/workflows/test_and_deploy.yml

@@ -2,7 +2,7 @@ name: Python test and deploy
 
 on:
   release:
-    types: [created]
+    types: [published]
 
 
 jobs:
@@ -36,26 +36,26 @@ jobs:
   deploy:
     needs: test
     runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v6
       - name: Set Up Build
         uses: actions/setup-python@v6
         with:
           python-version: "3.14"
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -e .[deploy]
-      - name: Update RC Version
+      - name: Check VERSION matches the release tag
         run: |
-          python scripts/update_version.py ${GITHUB_REF}
+          version="$(cat VERSION)"
+          if [ "v$version" != "$GITHUB_REF_NAME" ]; then
+            echo "VERSION ($version) does not match release tag ($GITHUB_REF_NAME)" >&2
+            exit 1
+          fi
       - name: Build Dist
         run: |
-          rm -rf dist/*
+          python -m pip install --upgrade pip build
           python -m build
-      - name: Publish
-        env:
-          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        run: |
-          python scripts/upload_new_package.py
+      # Trusted Publishing (OIDC): the repo is registered as a publisher on PyPI (api-client -> Settings -> Publishing) for the `pypi` environment.
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

CONTRIBUTING.md

@@ -0,0 +1,44 @@
+# Contributing
+
+## Development setup
+
+The library supports Python 3.9 to 3.14. Create a virtual environment and
+install the package with its development dependencies:
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+pip install -e '.[dev]'
+```
+
+## Tests and linting
+
+Available Makefile commands:
+
+```bash
+make test      # run the test suite
+make lint      # check formatting and style (isort, black, flake8)
+make format    # apply isort and black fixes
+make check     # lint + test — run this before pushing
+```
+
+## Releasing
+
+Releases publish to [PyPI](https://pypi.org/project/api-client/) automatically
+when a GitHub Release is published, using
+[PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/).
+
+To release:
+
+1. Bump the version in the `VERSION` file in a pull request and merge it.
+2. Publish a GitHub Release whose tag is `v<VERSION>`
+   (for example, `v1.4.0` for `VERSION` `1.4.0`).
+
+Publishing the release triggers the `Python test and deploy` workflow, which
+runs the full test suite, verifies the tag matches `VERSION`, builds the sdist
+and wheel, and publishes them to PyPI. A tag that does not match `VERSION`
+fails the release before anything is published.
+
+For a pre-release, tag it as a PEP 440 pre-release (for example, `v1.4.0rc1`,
+with `VERSION` set to `1.4.0rc1`) and tick the "Set as a pre-release" box on the
+GitHub Release.

setup.py

@@ -9,7 +9,7 @@
 lint_dependencies = ["flake8", "flake8-docstrings", "black", "isort"]
 docs_dependencies = []
 dev_dependencies = test_dependencies + lint_dependencies + docs_dependencies + ["ipdb"]
-deploy_dependencies = ["build", "requests", "twine"]
+deploy_dependencies = ["build"]
 
 
 with open("README.md", "r") as fh: