Move PyPI administration to individual accounts and Trusted Publishing #84

Recommendation

Use Alexei's individual PyPI account boronine for human administration and OIDC Trusted Publishing for automated uploads, rather than sharing credentials for the ordinary user account hsluv.

A user account named hsluv is not automatically a PyPI organization. Confirm whether the existing group account is an ordinary user account or a real organization before making changes; its type and current project permissions have not been verified.

Current official guidance (checked October 21, 2026)

• PyPI Terms of Service — Account Requirements: “Your login may only be used by one person — i.e., a single login may not be shared by multiple people.” The terms separately describe limited legacy machine-account exceptions; these are not a general permission to share an interactive login.
• PyPI organization accounts are the supported model for groups: individual users sign in separately and receive organization/team/project roles. Community organizations are free.
• PyPI strongly recommends Trusted Publishing for supported CI providers. Trusted Publishing uses OIDC to obtain short-lived upload credentials instead of storing a human password or long-lived API token in CI.
• Project collaborator roles distinguish Owners (project and collaborator administration, uploads and deletion) from Maintainers (uploads).

Checklist for Alexei

• Inspect the existing hsluv PyPI project's collaborators and confirm that boronine has the Owner role. If necessary, use the current owner's access to invite boronine, accept the invitation, and verify administration works before removing any existing access.
• Ensure each human maintainer uses their own PyPI account with 2FA and securely stored recovery codes. Grant the least privileges needed.
• Consider adding a second trusted individual Owner for continuity and recovery; this is a project recommendation, not a stated PyPI requirement.
• Configure the existing package's GitHub Trusted Publisher using the workflow prepared in Add manual PyPI publishing workflow #81, following PyPI's setup instructions. Configure it while signed in as an authorized project Owner; subsequent CI uploads authenticate through the workflow, not that person's login.
• Optionally establish a genuine community PyPI organization for HSLuv, add individual members, and transfer the existing project into it. An organization is useful for governance but is not required for OIDC.
• Once individual-owner access and the publishing setup are verified, retire the shared-login arrangement if hsluv is an ordinary user account. Review and revoke obsolete CI tokens after confirming their replacements work. Do not delete an account until all projects and access dependencies have been checked.

Safety and scope

Do not delete or recreate the PyPI package. These changes do not require changing the package name, pip install hsluv, author metadata, or license.

Configuring accounts and a Trusted Publisher is not authorization to publish a release. Keep the actual pre-release publication as a separately approved follow-up to #81.