ci: use OIDC trusted publishing and SHA-pin pypi-publish in release.yml

[farhan]

Important

PR implemented with the assistance of Claude Code. Refined and validated before being submitted for code review.

Modernize release.yml
Part of openedx/public-engineering#506

Summary

• Switch PyPI publishing to OIDC trusted publishing — remove the user: __token__ / password: ${{ secrets.PYPI_UPLOAD_TOKEN }} inputs.
• Set up automated changelog generation for python-semantic-release:
  • Add CHANGELOG.rst with the .. changelog-insertion-marker that PSR updates on each release.
  • Add [tool.semantic_release.changelog] config to pyproject.toml (mode = "update", insertion_flag = ".. changelog-insertion-marker", and default_templates pinning changelog_file = "CHANGELOG.rst" / output_format = "rst" so PSR writes the .rst file instead of the default CHANGELOG.md).
  • Drop the changelog: "false" input from the Run Semantic Release step in release.yml so the changelog is generated on release.

Important Notes

• A PyPI trusted publisher (OIDC) must be configured for this project before this PR is merged, otherwise the publish step will fail. Configure it in the project's PyPI settings pointing at this repo, release.yml, and the publish_to_pypi job.
• Once merged, PYPI_UPLOAD_TOKEN is no longer used and can be removed from repo secrets.
• The changelog config mirrors the openedx/xblock-sdk reference implementation. CHANGELOG.rst is auto-managed by PSR — entries below the insertion marker should not be edited by hand.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.17%. Comparing base (0e85d6a) to head (8def36e).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #64   +/-   ##
=======================================
  Coverage   82.17%   82.17%           
=======================================
  Files          48       48           
  Lines        1419     1419           
  Branches      110      110           
=======================================
  Hits         1166     1166           
  Misses        221      221           
  Partials       32       32           

Flag	Coverage Δ
unittests	82.17% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.