PyPI Trusted Publishing Branch Scoping Gap
The goal is to determine the enforcement boundary for branch identifiers when using PyPI Trusted Publishing with OIDC-based tokenless uploads. Publisher bindings specify repository, workflow filename, and optionally environment, but do not include a branch or ref constraint. OIDC tokens emitted by CI providers carry branch information such as ref: refs/heads