[anth-volk]

• make format && make documentation has been run. (Not applicable: this PR changes only workflow YAML and changelog files.)

What's changed

Moves PyPI publishing from the shared org-wide secrets.PYPI token to PyPI trusted publishing (OIDC).

In .github/workflows/push.yaml, the Publish job (the one that runs pypa/gh-action-pypi-publish) now:

• runs in the pypi environment (environment: pypi)
• has job-level permissions: contents: write (kept because publish-git-tag.sh pushes a tag; the repo default token is already write) + id-token: write
• no longer passes user: __token__ / password: ${{ secrets.PYPI }}. The action ignores OIDC while a password is given, so these had to go. skip_existing is kept.

The pypi environment already exists in this repo and is limited to master. This PR does not change any repo settings, environments or secrets. secrets.PYPI is not used anywhere else under .github/.

Merging cuts a patch release via changelog.d/trusted-publishing.changed.md. .github/bump_version.py returns major only for breaking, minor for added/removed, and patch otherwise, so changed gives a patch bump. Running bump_version.py and towncrier build locally on this branch gives 0.99.0 -> 0.99.1.

Fix for the broken release pipeline

The Update versioning job has failed on every push to master since #550 (2026-03-18), including the 2026-04-28 run. The reason: #550 and #551 put their fragments under changelog.d/fixed/. bump_version.py only looks at files at the top of changelog.d/, so it saw none and exited with No changelog fragments found. I reproduced this locally on master. This PR moves the two fragments to changelog.d/<name>.fixed.md, the layout towncrier and the PR check suggest. With that, they also go into the 0.99.1 changelog, so the #550 enum fix and the #551 workflow change finally get released. Without the move, the bump would still pass but towncrier would quietly skip those two entries.

Not fixed here (it does not block the PyPI upload): publish-git-tag.sh calls python setup.py --version, but there is no setup.py, so no tag gets pushed (the || true hides the error).

Before merging

Add a trusted publisher on PyPI (project settings, Publishing) with these values:

Field	Value
PyPI project	policyengine-canada
Owner	PolicyEngine
Repository	policyengine-canada
Workflow filename	push.yaml
Environment	pypi

If this PR is merged before the publisher is added, the publish step fails with invalid-publisher and that release does not reach PyPI.

Test plan

• actionlint on .github/workflows/push.yaml: no new findings compared with master.
• Ran the release step locally on this branch; it computes a patch bump (see above).
• PR checks pass.
• After the PyPI publisher is added and this is merged, the Publish job's deployment to pypi uploads the new patch version to https://pypi.org/project/policyengine-canada/ with no token.

🤖 Generated with Claude Code