Publish google-adk to PyPI with Trusted Publishing (no stored token, add attestations) #7333

🔴 Required Information

Is your feature request related to a specific problem?

.github/workflows/release-publish.yml uploads google-adk with a long-lived PyPI token (UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}). The token is available in the same job that installs build tooling with the uv cache enabled, and that also holds RELEASE_PAT. As a result, published releases carry no provenance: google-adk 2.10.0 has no PEP 740 attestations on PyPI.

ADK is increasingly used in enterprise agent deployments, and users are starting to verify where their dependencies were built.

Describe the Solution You'd Like

Split release-publish.yml into three jobs:

• build: read-only, uv cache off. Runs the existing version handling and uv build.
• publish: id-token: write only, pypi environment. Uploads with PyPI Trusted Publishing (pypa/gh-action-pypi-publish), which also adds attestations.
• merge-back: creates the merge-back PR with RELEASE_PAT, as today.

No change to versioning, the branch check, or the release flow.

Impact on your work

Supply-chain hardening. It removes a long-lived publishing credential, and it lets ADK users verify that each release was built by this workflow.

Willingness to contribute

Yes. I've signed the Google CLA and have the change prepared. I'll open a PR once a maintainer confirms the direction.

🟡 Recommended Information

Describe Alternatives You've Considered

uv publish --trusted-publishing always in the existing job. That removes the stored token, but the credential would still share a job with build tooling and RELEASE_PAT, and uv does not generate attestations. PyPA recommends separate build and publish jobs.

Additional Context

• PyPI Trusted Publishing: https://docs.pypi.org/trusted-publishers/
• PEP 740 attestations: https://peps.python.org/pep-0740/
• pypa/gh-action-pypi-publish (security model): https://github.com/pypa/gh-action-pypi-publish

Related

• fix(ci): resolve zizmor security findings in GitHub Actions workflows #6601 proposed adding id-token: write for Trusted Publishing, but that part isn't in the imported commit (0075954); only the persist-credentials and version-comment changes landed. If Trusted Publishing was left out deliberately (for example because of internal release constraints), I'd appreciate knowing why, and I'm happy to adjust the approach.
• Release publish workflow no longer requires green checks for the exact commit #7304 also touches release-publish.yml (the check gate removed in e143cce). This proposal doesn't change that behaviour, so the two are independent.