ci: use trusted publishing in release pipeline and trigger on tags

[Yonghui-Lee]

This PR makes release pipeline automatically run tests, build packages, create GitHub releases, and publish to PyPI upon a new tag push.

Close #1866

Key Changes

1. CI Workflow (main.yaml):
   • Added the workflow_call trigger to allow the CI workflow to be called by the release workflow.
2. Release Pipeline (pypipublish.yaml):
   • Trigger: Configured to trigger automatically on CalVer tag pushes (e.g., 2026.6.0).
   • CI Dependency: Added a ci job dependency to ensure all tests pass before any build or publish steps run.
   • Build: Uses the standard build module to generate source distributions and wheels.
   • GitHub Release: Automatically creates a GitHub release, generates release notes, and attaches the build artifacts.
   • PyPI Publish: Switched from legacy username/password secrets to Trusted Publishing (OIDC) using the official pypa/gh-action-pypi-publish action.

Setup Required

Trusted Publishing must be configured on PyPI.

[Yonghui-Lee]

Hi @martindurant. Could you help take a look at this PR? The release process has been validated in gcsfs. We also want to automate the release process of fsspec. Based on this, we can also Implement a mechanism to gate fsspec releases to ensure compatibility with E2E tests.

[martindurant]

OK, I suppose it's fine. Will need to do s3fs too, but we can let that wait one more release, since this one is different enough from gcsfs's.

[martindurant]

Publisher added on pypi

[EpicWink]

Suggested change

	environment: pypi
	environment:
	name: pypi
	url: https://pypi.org/p/fsspec

Including URL adds a link to the deployments page