CI: add PyPI Trusted-Publishing “publish” job to wheels workflow (#61669)

.github/workflows/wheels.yml

@@ -219,3 +219,38 @@ jobs:
           source ci/upload_wheels.sh
           set_upload_vars
           upload_wheels
+
+  publish:
+    if: github.repository == 'pandas-dev/pandas' && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    needs:
+      - build_sdist
+      - build_wheels
+    runs-on: ubuntu-latest
+
+    environment:
+      name: pypi
+
+    permissions:
+      id-token: write               # OIDC token for Trusted Publishing
+      contents: read
+
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist                # all files land in ./dist/**
+
+      - name: Collect files
+        run: |
+          mkdir -p upload
+          # skip anything containing 'pyodide' in the filename
+          find dist -name '*pyodide*.whl' -prune -o \
+                    -name '*.whl'   -exec mv {} upload/ \;
+          find dist -name '*.tar.gz' -exec mv {} upload/ \;
+
+      - name: Publish to PyPI (Trusted Publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://upload.pypi.org/legacy/
+          packages-dir: upload
+          skip-existing: true

doc/source/whatsnew/v3.0.0.rst

@@ -91,6 +91,7 @@ Other enhancements
 - Support passing a :class:`Iterable[Hashable]` input to :meth:`DataFrame.drop_duplicates` (:issue:`59237`)
 - Support reading Stata 102-format (Stata 1) dta files (:issue:`58978`)
 - Support reading Stata 110-format (Stata 7) dta files (:issue:`47176`)
+- Switched wheel upload to **PyPI Trusted Publishing** (OIDC) for release-tag pushes in ``wheels.yml``. (:issue:`61718`)
 
 .. ---------------------------------------------------------------------------
 .. _whatsnew_300.notable_bug_fixes: