Note

Medium Risk
Moderate risk because it rewires the release/publish pipeline (trigger, permissions, artifact flow, and version gating), which could break publishing if misconfigured. It reduces secret-handling risk by removing reliance on a long-lived PYPI_TOKEN.

Overview
Switches PyPI releases from the Speakeasy publish workflow + PYPI_TOKEN secret to a GitHub Releases-triggered pipeline that builds with uv, validates the release tag matches unstructured_client._version, and publishes via trusted publishing (OIDC) using pypa/gh-action-pypi-publish.

Removes PyPI publishing configuration from Speakeasy (.speakeasy/workflow*.yaml) and stops passing pypi_token into the SDK generation workflow, while bumping SDK/package versioning to 0.43.2 (generator config + _version.py) and adding regression tests that enforce the new release workflow invariants.

^{Reviewed by Cursor Bugbot for commit 4d38845. Bugbot is set up for automated code reviews on this repo. Configure here.}