Migrate PyPI publishing to Trusted Publishing (OIDC)

[ajinabraham]

Summary

• Switch .github/workflows/publish.yml from twine + PYPI_USERNAME/PYPI_PASSWORD to PyPI Trusted Publishing via pypa/gh-action-pypi-publish
• Require id-token: write and a GitHub Environment named pypi
• Build with python -m build instead of python setup.py sdist bdist_wheel
• Trigger on release: published (skips draft releases)

Manual setup (required before first release)

1. On PyPI: mobsfscan → Publishing → add Trusted Publisher:
   • Owner: MobSF
   • Repository: mobsfscan
   • Workflow: publish.yml
   • Environment: pypi
2. On GitHub: Settings → Environments → create pypi (optional protection rules)
3. After the first successful OIDC publish, delete repo secrets PYPI_USERNAME and PYPI_PASSWORD

Test plan

• Confirm PyPI trusted publisher matches this workflow filename/environment
• Confirm GitHub Environment pypi exists
• Publish a GitHub Release (or dry-run on TestPyPI if preferred) and verify upload succeeds without API token secrets

Made with Cursor

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.