updates to release process

[shrutiburman]

https://github.com/twilio/twilio-python/actions/runs/30338829496/job/90209602082?pr=941
Migrate PyPI publishing to OIDC trusted publishing

New Release flow-

[Librarian]git tag vX.Y.Z && git push --tags →
[Github Actions] test → approve [Manual] → GitHub Release → publish to Pypi

deploy.yml — New release workflow (replaces test-and-deploy.yml's publish path)

• Keyless publish to PyPI via OIDC trusted publishing — no more stored PYPI_TOKEN
• Triggered on tag push (v*), creates GitHub Release automatically
• production environment approval gate before publish
• Tag format validation (vX.Y.Z) + version match against setup.py
• PEP 740 attestations on every release
• Dependencies resolved through curated Artifactory (ecosystem: python)
• Lockfile hygiene scan on requirements*.txt
• Full test matrix (3.8–3.13) with fail-fast: false

test-release.yml — Weekly pre-release readiness check

• Runs every Monday 9AM IST + manual dispatch
• Validates lockfile hygiene (no internal Artifactory hosts in requirements files)
• Full test + build pipeline
• Validates version format, builds sdist/wheel, verifies with twine check
• Does NOT publish — dry run only
• Slack notification on cron failure

Also in this PR

• Switched from local .github/artifactory-oidc to shared twilio/sdk-actions/artifactory-oidc with
  ecosystem: python
• Deleted local .github/artifactory-oidc/ composite action
• Updated actions/checkout SHA to Node 24-compatible version

Prerequisites (before first real release)

• PyPI trusted publisher registered for twilio package (owner: twilio, repo: twilio-python,
  workflow: deploy.yml, environment: production)
• production GitHub environment created with required reviewers
• Repo added to Artifactory OIDC trust — SSC team
• Repo added to ubuntu-x64 runner group — Enterprise admin
• vars.ARTIFACTORY_URL set to https://twilio.jfrog.io

Checklist

• I acknowledge that all my contributions will be made under the project's license
• I have made a material change to the repo (functionality, testing, spelling, grammar)
• I have read the Contribution Guidelines and my PR follows them
• I have titled the PR appropriately
• I have updated my branch with the main branch
• I have added tests that prove my fix is effective or that my feature works
• I have added the necessary documentation about the functionality in the appropriate .md file
• I have added inline documentation to the code I modified

If you have questions, please file a support ticket, or create a GitHub Issue in this repository.