ci(release): publish to PyPI with the PYPI_API_TOKEN secret instead of OIDC trusted publishing

Co-authored-by: Cursor <cursoragent@cursor.com>

.github/workflows/release.yml

@@ -1,12 +1,13 @@
 name: Release
 
-# Tag-driven release: run the test gate, build, publish to PyPI via trusted
+# Tag-driven release: run the test gate, build, publish to PyPI, then cut the
-# publishing (OIDC — no API token stored in the repo), then cut the GitHub
+# GitHub Release with the built artifacts attached.
-# Release with the built artifacts attached.
 #
-# One-time setup on PyPI (manual): project "autocad-mcp-pro" -> Publishing ->
+# Auth: the PYPI_API_TOKEN repository secret (an API token from
-# add GitHub publisher repo=U-C4N/Autocad-MCP workflow=release.yml
+# https://pypi.org/manage/account/token/). Once the project exists on PyPI,
-# environment=pypi.
+# prefer replacing it with a project-scoped token — or switch back to trusted
+# publishing (OIDC) by restoring `environment: pypi` + `id-token: write` and
+# registering the publisher on PyPI.
 
 on:
   push:
@@ -57,16 +58,15 @@ jobs:
   publish-pypi:
     needs: build
     runs-on: ubuntu-latest
-    environment: pypi
-    permissions:
-      id-token: write
     steps:
       - uses: actions/download-artifact@v4
         with:
           name: dist
           path: dist/
-      - name: Publish to PyPI (trusted publishing)
+      - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
 
   github-release:
     needs: publish-pypi