CI: add PyPI Trusted-Publishing “publish” job to wheels workflow (#61669)

.github/workflows/wheels.yml

@@ -219,3 +219,43 @@ jobs:
           source ci/upload_wheels.sh
           set_upload_vars
           upload_wheels
+
+################################################
+# Publish Wheels and Source Distribution to PyPI
+################################################
+  publish:
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - build_sdist
+      - build_wheels
+    runs-on: ubuntu-latest
+
+    environment:
+      name: pypi
+
+    permissions:
+      id-token: write               # OIDC token for Trusted Publishing
+      contents: read
+
+    steps:
+      # 1. Pull every artifact produced by the two upstream jobs
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist                # all files land in ./dist/**
+
+      # 2. Move wheels & sdist into a flat 'upload' dir (skip Pyodide wheels)
+      - name: Collect files
+        run: |
+          mkdir -p upload
+          # skip anything containing 'pyodide' in the filename
+          find dist -name '*pyodide*.whl' -prune -o \
+                    -name '*.whl'   -exec mv {} upload/ \;
+          find dist -name '*.tar.gz' -exec mv {} upload/ \;
+
+      # 3. Publish to PyPI using Trusted Publishing
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://upload.pypi.org/legacy/
+          packages-dir: upload

doc/source/whatsnew/v3.0.0.rst

@@ -665,6 +665,14 @@ Performance improvements
 - Performance improvement in indexing operations for string dtypes (:issue:`56997`)
 - Performance improvement in unary methods on a :class:`RangeIndex` returning a :class:`RangeIndex` instead of a :class:`Index` when possible. (:issue:`57825`)
 
+.. ---------------------------------------------------------------------------
+.. _whatsnew_300.build:
+
+Build / CI
+~~~~~~~~~~
+
+- Switched wheel upload to **PyPI Trusted Publishing** (OIDC) for release-tag pushes in ``wheels.yml``. (:issue:`61718`)
+
 .. ---------------------------------------------------------------------------
 .. _whatsnew_300.bug_fixes: