Update publish to use ODIC token

.github/workflows/cd.yml

@@ -4,9 +4,14 @@ on:
     branches:
       - main
     paths:
-      - "src/pytest_nhsd_apim/**"
-      - "pyproject.toml"
-      - "setup.py"
+      - 'src/pytest_nhsd_apim/**'
+      - 'pyproject.toml'
+      - 'setup.py'
+
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -19,15 +24,6 @@ jobs:
         with:
           python-version: 3.13
 
-      - name: install gnome-keyring
-        run: |
-          sudo apt-get update
-          echo "Available versions of gnome-keyring:"
-          apt-cache policy gnome-keyring
-
-          echo "Installing default candidate version"
-          sudo apt-get install -y gnome-keyring
-
       - name: install deps
         run: make install-deps
 
@@ -40,8 +36,6 @@ jobs:
       - name: check build
         run: twine check dist/*
 
-      - name: set poetry credentials
-        run: poetry config pypi-token.pypi ${{ secrets.PYPI_TOKEN }}
+      - name: Publish to PyPI (OIDC)
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
 
-      - name: publish
-        run: poetry publish

.pre-commit-config.yaml

@@ -0,0 +1,10 @@
+repos:
+- repo: local
+  hooks:
+  - id: scan-secrets
+    name: Scan secrets
+    entry: ./scripts/githooks/scan-secrets.sh
+    env:
+      check: staged-changes
+    language: script
+    pass_filenames: false