Comment by junon

> Sorry, what's the threat model in which you're giving people write access to your repository but assuming that they can't publish?

So that I'm the arbiter of what people download, and can review locally what changes were made prior to pushing it out to everyone.

> To establish a baseline here: the assumption with Trusted Publishing is that people are already using CI/CD to publish to places like PyPI.

That's not the narrative. People have been saying to switch to trusted publishing from local publishes. They're not 1:1 compatible. I agree that if you already publish via CD, then it probably already worked for your org and thus is a no brainer.

> If this isn't your user model, that's perfectly fine. But in that case you shouldn't be using CI/CD to publish at all (which is also fine); it's not an issue with Trusted Publishing per se.

That's exactly the point I'm making.