From 5e1576442acbe0633e57e7699d8daa25fb28eb38 Mon Sep 17 00:00:00 2001
From: Tristan Simas <tristan.simas@mail.mcgill.ca>
Date: Mon, 5 Oct 2026 14:10:08 -0400
Subject: [PATCH] fix: keep publisher authentication out of artifact readiness

---
 scripts/verify_release_ready.py | 11 +++--------
 tests/test_release_readiness.py | 17 +++++++++++++++++
 2 files changed, 20 insertions(+), 8 deletions(-)
 create mode 100644 tests/test_release_readiness.py

diff --git a/scripts/verify_release_ready.py b/scripts/verify_release_ready.py
index 736c503..1f0ee52 100755
--- a/scripts/verify_release_ready.py
+++ b/scripts/verify_release_ready.py
@@ -211,13 +211,8 @@ def check_github_workflow():
         print("  ❌ .github/workflows/publish.yml not found")
         return False
     
-    content = workflow_file.read_text()
-    if 'PYPI_API_TOKEN' not in content:
-        print("  ❌ PYPI_API_TOKEN not referenced in workflow")
-        return False
-    
-    print("  ✅ GitHub Actions workflow configured")
-    print("     Remember to set PYPI_API_TOKEN secret in GitHub!")
+    print("  ✅ Publication workflow present")
+    print("     Authentication is checked by the workflow's publisher, not artifact readiness.")
     return True
 
 
@@ -261,7 +256,7 @@ def main():
     if passed == total:
         print("\n🎉 All checks passed! Ready for release!")
         print("\nNext steps:")
-        print("  1. Set PYPI_API_TOKEN in GitHub secrets")
+        print("  1. Verify the publication workflow's PyPI authorization")
         print("  2. Run: python scripts/update_and_release.py")
         return 0
     else:
diff --git a/tests/test_release_readiness.py b/tests/test_release_readiness.py
new file mode 100644
index 0000000..6963e25
--- /dev/null
+++ b/tests/test_release_readiness.py
@@ -0,0 +1,17 @@
+"""Artifact readiness does not require a publisher's authentication secret."""
+
+import runpy
+from pathlib import Path
+
+
+CHECKS = runpy.run_path(str(Path(__file__).parents[1] / "scripts/verify_release_ready.py"))
+
+
+def test_actual_trusted_publishing_workflow_passes_readiness(monkeypatch):
+    monkeypatch.chdir(Path(__file__).parents[1])
+    assert CHECKS["check_github_workflow"]()
+
+
+def test_missing_publication_workflow_is_rejected(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    assert not CHECKS["check_github_workflow"]()