chore: trusted publishing (#795)

fixes #794

---------

Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: semantic-release <[email protected]>
Co-authored-by: semantic-release <[email protected]>

Author: jkowalleck

.github/workflows/release.yml

@@ -126,7 +126,7 @@ jobs:
         # see https://github.com/pypa/gh-action-pypi-publish
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.PYPI_TOKEN }}
+          attestations: true
       - name: Publish package distributions to GitHub Releases
         if: |
           !failure() && !cancelled() &&

CHANGELOG.md

@@ -2,6 +2,15 @@
 
 
 
+## v4.6.1-alpha.1 (2024-09-23)
+
+### Chore
+
+* chore: trusted publishing
+
+Signed-off-by: Jan Kowalleck <[email protected]> ([`07b5e83`](https://github.com/CycloneDX/cyclonedx-python/commit/07b5e83c18fd3c02f917bca1faa00d42e6665647))
+
+
 ## v4.6.0 (2024-09-20)
 
 ### Documentation

cyclonedx_py/__init__.py

@@ -17,7 +17,7 @@
 
 # !! version is managed by `semantic_release`
 # do not use typing here, or else `semantic_release` might have issues finding the variable
-__version__ = "4.6.0"  # noqa:Q000
+__version__ = "4.6.1-alpha.1"  # noqa:Q000
 
 # There is no stable/public API.
 # However, you might call the stable CLI instead, like so:

docs/conf.py

@@ -22,7 +22,7 @@
 
 # The full version, including alpha/beta/rc tags
 # !! version is managed by semantic_release
-release = "4.6.0"
+release = "4.6.1-alpha.1"
 
 # -- General configuration ---------------------------------------------------
 

pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "poetry.core.masonry.api"
 [tool.poetry]
 # keep in sync with `cyclonedx_py/_internal/utils/cdx.py`
 name = "cyclonedx-bom"
-version = "4.6.0"
+version = "4.6.1-alpha.1"
 description = "CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments"
 authors = [
   "Jan Kowalleck <[email protected]>",