updates to release process

[shrutiburman]

https://github.com/twilio/twilio-python/actions/runs/30338829496/job/90209602082?pr=941
Migrate PyPI publishing to OIDC trusted publishing

New Release flow-

[Librarian]git tag vX.Y.Z && git push --tags →
[Github Actions] test → approve [Manual] → GitHub Release → publish to Pypi

deploy.yml — New release workflow (replaces test-and-deploy.yml's publish path)

• Keyless publish to PyPI via OIDC trusted publishing — no more stored PYPI_TOKEN
• Triggered on tag push (v*), creates GitHub Release automatically
• production environment approval gate before publish
• Tag format validation (vX.Y.Z) + version match against setup.py
• PEP 740 attestations on every release
• Dependencies resolved through curated Artifactory (ecosystem: python)
• Lockfile hygiene scan on requirements*.txt
• Full test matrix (3.8–3.13) with fail-fast: false

.github/workflows/ci.yml— Weekly pre-release readiness check

• Runs every Monday 9AM IST + manual dispatch
• Validates lockfile hygiene (no internal Artifactory hosts in requirements files)
• Full test + build pipeline
• Validates version format, builds sdist/wheel, verifies with twine check
• Does NOT publish — dry run only
• Slack notification on cron failure

Also in this PR

• Switched from local .github/artifactory-oidc to shared twilio/sdk-actions/artifactory-oidc with
  ecosystem: python
• Deleted local .github/artifactory-oidc/ composite action
• Updated actions/checkout SHA to Node 24-compatible version

Prerequisites (before first real release)

• PyPI trusted publisher registered for twilio package (owner: twilio, repo: twilio-python,
  workflow: deploy.yml, environment: production)
• production GitHub environment created with required reviewers
• Repo added to Artifactory OIDC trust — SSC team
• Repo added to ubuntu-x64 runner group — Enterprise admin
• vars.ARTIFACTORY_URL set to https://twilio.jfrog.io

Checklist

• I acknowledge that all my contributions will be made under the project's license
• I have made a material change to the repo (functionality, testing, spelling, grammar)
• I have read the Contribution Guidelines and my PR follows them
• I have titled the PR appropriately
• I have updated my branch with the main branch
• I have added tests that prove my fix is effective or that my feature works
• I have added the necessary documentation about the functionality in the appropriate .md file
• I have added inline documentation to the code I modified

If you have questions, please file a support ticket, or create a GitHub Issue in this repository.

[shrutiburman]

We should be using uses: sendgrid/dx-automator/actions/release@main release here but that is currently blocked

Tradeoff-
gh release create --generate-notes: auto-generates notes from PR titles and commit messages since the last tag. No changelog file involved.
dx-automator/actions/release: reads CHANGES.md (or CHANGELOG.md) in the repo, finds the section matching the release version, and uses that as the release body. So the release notes on GitHub match exactly what's written in the changelog file.

[shrutiburman]

test run
throws exception from inside the action, as expected