Greptile Summary

This PR adds a GitHub Actions workflow (.github/workflows/publish.yml) to automate publishing iotcli to PyPI using OIDC Trusted Publishing — no long-lived API tokens required. The workflow triggers on v* tags, extracts the version from the tag name to patch pyproject.toml, builds a wheel + sdist, and publishes via pypa/gh-action-pypi-publish.

Key changes:

• New publish workflow using PyPI Trusted Publishing (OIDC), scoped to a pypi GitHub Environment for manual approval gating
• Version is now dynamically extracted from the pushed git tag via sed before building, resolving the static 0.10.0 issue raised in prior review
• pypa/gh-action-pypi-publish is pinned to a full commit SHA (cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0) rather than a mutable branch
• The github.actor guard and hardcoded API token path have been removed in favour of proper Trusted Publishing

Remaining concern:

• actions/checkout@v4 and actions/setup-python@v5 are still mutable tags. In a publish workflow the checkout and Python setup steps execute code that directly affects what ends up in the published package, so they warrant the same SHA-pinning treatment as the publish action itself.

sequenceDiagram
    participant Dev as Developer
    participant GH as GitHub Actions
    participant Env as pypi Environment
    participant PyPI as PyPI (OIDC)

    Dev->>GH: git push tag v*
    GH->>GH: Trigger publish workflow
    GH->>Env: Request environment approval
    Env-->>GH: Approved by reviewer
    GH->>GH: actions/checkout
    GH->>GH: sed version from tag into pyproject.toml
    GH->>GH: actions/setup-python
    GH->>GH: pip install build
    GH->>GH: python -m build (wheel + sdist)
    GH->>PyPI: pypa/gh-action-pypi-publish (OIDC token exchange)
    PyPI-->>GH: Publish confirmed

_{Reviews (6): Last reviewed commit: "fix(ci): remove hardcoded actor guard — ..." | Re-trigger Greptile}

@greptile review

@greptile review

@greptile review

@greptile review

@greptile review