Post

Publishing to Pypi
Bad: twine with an API key
Better: Github action with OIDC/Trusted Publisher
Even better: GHA env requires manual approval
Best: GHA triggered by GH 'Release' page creation and manual approval on publish step.