ci: publish to PyPI via trusted publishing instead of an API token

.github/workflows/pre-release.yml

@@ -157,6 +157,9 @@ jobs:
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
     environment: release
+    permissions:
+      id-token: write  # mint the OIDC token PyPI trusted publishing verifies
+      contents: read  # actions/checkout
 
     steps:
       - name: Checkout Pyqasm
@@ -174,6 +177,3 @@ jobs:
 
       - name: Publish package to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}

.github/workflows/release.yml

@@ -148,6 +148,9 @@ jobs:
     needs: [build_wheels, build_sdist]
     runs-on: ubuntu-latest
     environment: release
+    permissions:
+      id-token: write  # mint the OIDC token PyPI trusted publishing verifies
+      contents: read  # actions/checkout
 
     steps:
       - name: Checkout PyQASM
@@ -165,6 +168,3 @@ jobs:
 
       - name: Publish package to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}

CHANGELOG.md

@@ -30,6 +30,7 @@ Types of changes:
 ### Dependencies
 
 ### Other
+- Switched PyPI publishing from a long-lived `PYPI_API_TOKEN` repository secret to trusted publishing. The publish job now mints a short-lived OIDC credential scoped to that one workflow, and the action attaches PEP 740 attestations recording the repository, workflow and commit SHA behind each uploaded file. Attestations apply to releases published after this merges, not retroactively. ([#411](https://github.com/qBraid/pyqasm/pull/411))
 - Fixed the pre-release build stamping a version that `pyqasm.__version__` and the package metadata spelled differently. `pre_build.sh` wrote `1.1.0-a.0` into `pyproject.toml`, setuptools normalized that to `1.1.0a0` for the metadata, and `_version.py` kept the raw string, so `pip show pyqasm` and `pyqasm.__version__` disagreed and `test_sdist.sh` failed its version check. The stamped version is now normalized to PEP 440 before it is written. ([#414](https://github.com/qBraid/pyqasm/pull/414))
 - Fixed the pre-release workflow publishing its source distribution under the released version instead of the pre-release one. `build_sdist.sh` ran `git reset --hard` and `git clean -xdf`, which discarded the `pyproject.toml` version that the preceding step had just stamped, so a run that built `1.1.0a0` wheels built a `1.1.0` sdist and PyPI rejected it as a duplicate. `pre_build.sh` already resets the tree, so the second reset is gone. It also no longer destroys uncommitted work when the script is run locally. ([#413](https://github.com/qBraid/pyqasm/pull/413))
 - Added a `SECURITY.md` with a private vulnerability disclosure path. There was no documented way to report one, leaving a public issue or a guessed email address as the only options. Reports now go through this repository's GitHub security advisory form. ([#383](https://github.com/qBraid/pyqasm/pull/383))

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pyqasm"
-version = "1.1.0"
+version = "1.2.0-alpha"
 description = "Python toolkit providing an OpenQASM 3 semantic analyzer and utilities for program analysis and compilation."
 authors = [{name = "qBraid Development Team"}, {email = "contact@qbraid.com"}]
 readme = "README.md"