From ad950ba81c8e34de92d368ede51f5810cfb99f5c Mon Sep 17 00:00:00 2001
From: Brendan Ryan <1572504+brendanjryan@users.noreply.github.com>
Date: Sat, 2 May 2026 11:59:46 -0700
Subject: [PATCH] ci: grant OIDC perms and release env to changelogs publish
 job

The wevm/changelogs action runs twine upload itself from the `release`
job, but that job had neither `id-token: write` nor `environment: release`,
so PyPI Trusted Publishing rejected the upload with 403 Forbidden.

Add both to the `release` job so the OIDC token issued matches the
PyPI trusted publisher entry (tempoxyz/pympp + publish.yml + release).
---
 .github/workflows/publish.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9165fe8..7ba3899 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,9 +12,11 @@ jobs:
   release:
     name: Version
     runs-on: ubuntu-latest
+    environment: release
     permissions:
       contents: write
       pull-requests: write
+      id-token: write
     outputs:
       published: ${{ steps.changelogs.outputs.published }}
     steps: