@vagrantc TL,DR: using OIDC to generate short-lived access tokens to publish from known publishers. Lots of docs: https://docs.pypi.org/trusted-publishers/