After several attempts, I've managed to streamline the workflow for building and publishing using OIDC. Here's an overview of the challenges I encountered and the solutions I found:

Incorrect Usage of Poetry for PyPI Token Configuration

Issue No.1: Initially, I used the command poetry config pypi-token.pypi <my-token>. This approach is incorrect in the context of OIDC because it statically sets a PyPI token in the Poetry configuration. When using OIDC, tokens are dynamically generated and provided as environment variables for each workflow run. Static tokens do not align with the dynamic and secure nature of OIDC tokens.

Solution: The correct approach is to use the command poetry -u __token__ -p {PYPI_API_TOKEN}. This command dynamically sets the PyPI token for each run. This method ensures that the latest, temporary OIDC token is used for each deployment, enhancing security and aligning with the best practices of CI/CD pipelines.

Reusing the Same Release Tag

Issue No.2: Consistently using the same release tag led to the triggering of older workflows, resulting in unexpected behavior.

Solution: To ensure that the latest workflow changes are applied, always use a unique release tag for each new release in GitHub. This practice ensures that each release is associated with the correct version of the workflow.