Problem

The repo's Deployments widget shows the `pypi` environment as failed even though django-admin-react 1.0.0 and 1.0.1 are both live on PyPI:

• The current `release.yml` only authenticates via OIDC Trusted Publishing.
• PyPI doesn't yet have a Trusted Publisher configured for this repo (one-time owner step tracked in Publish v1.0.0 to PyPI — one-time owner OIDC setup blocks the release workflow #564).
• Every `release: published` event therefore fires a deployment that fails at the upload step with `invalid-publisher`, then paints the widget red — even though I publish manually via `set -a; . ./.env; set +a && poetry publish`.

Change

Switch `release.yml` to token-based auth (the same path the maintainer uses locally) and make the publish step idempotent:

1. Token auth. Use `pypa/gh-action-pypi-publish`'s `password:` input with `secrets.PYPI_API_TOKEN`. Drop the `id-token: write` permission (token auth doesn't need OIDC).
2. Idempotency guard. Before uploading, query `pypi.org/pypi///json`. If the version is already on PyPI (manual publish already shipped it, or a previous workflow run partly succeeded), skip the upload and let the job — and the deployment — finish green. Defense-in-depth: `skip-existing: true` on the publish step still handles a race past the guard.
3. TestPyPI mirror gets the same treatment via `TESTPYPI_API_TOKEN` (only used for `workflow_dispatch` dry runs).

Trusted Publishing remains the longer-term goal — when #564 is finally configured on PyPI's side we can revert to the OIDC variant in a single commit. This patch unblocks today.

One-time owner step

After merge, add the PyPI token to repo secrets so the workflow can actually upload:

1. `./.env` → copy the value of `POETRY_PYPI_TOKEN_PYPI` (the `pypi-...` string).
2. Repo Settings → Secrets and variables → Actions → New repository secret
   • Name: `PYPI_API_TOKEN`
   • Value: the token from step 1
3. (Optional) same flow for `TESTPYPI_API_TOKEN` if you want green TestPyPI dry runs.

Once the secret is present, every future `v*` Release tag will:

• Build wheel + sdist
• Either upload to PyPI (if not already there) or skip (if you published manually first)
• Mark the `pypi` Deployment green either way

Re-running for v1.0.1

After merging + adding the secret, you can also re-trigger the v1.0.1 deployment by re-running the failed Actions run (Actions → "release" → the v1.0.1 run → Re-run all jobs). The idempotency guard will detect 1.0.1 is already on PyPI, skip the upload, and the deployment will go green — same Release tag, no new artifact.

Diff

• `.github/workflows/release.yml` — 79 +/-22

🤖 Generated with Claude Code