Use official action to publish package in CI

[EpicWink]

This enables trusted publishing (with attestations).

Tasks a maintainer needs to do:

• Create GitHub environments: test-opencv-python-release (for test-PyPI), opencv-python-rolling-release, and opencv-python-release
• Configure trusted publishers in PyPI: see below table (48 total)
• (Optional) remove the GitHub project secrets: OPENCV_PYTHON_ROLLING_PASSWORD, OPENCV_CONTRIB_PYTHON_ROLLING_PASSWORD, OPENCV_PYTHON_HEADLESS_ROLLING_PASSWORD, OPENCV_CONTRIB_PYTHON_HEADLESS_ROLLING_PASSWORD, PYPI_PASSWORD (test-PyPI), OPENCV_PYTHON_PASSWORD, OPENCV_CONTRIB_PYTHON_PASSWORD, OPENCV_PYTHON_HEADLESS_PASSWORD, OPENCV_CONTRIB_PYTHON_HEADLESS_PASSWORD
• (Optional) once this pull request is accepted, make a pre-release to test the configuration

Environment	PyPI	For each package	For each GitHub Actions workflow
test-opencv-python-release	Test	opencv-python opencv-contrib-python opencv-python-headless opencv-contrib-python-headless	build_wheels_macos.yml build_wheels_macos_m1.yml build_wheels_manylinux.yml build_wheels_windows.yml
opencv-python-release	Real	opencv-python opencv-contrib-python opencv-python-headless opencv-contrib-python-headless	build_wheels_macos.yml build_wheels_macos_m1.yml build_wheels_manylinux.yml build_wheels_windows.yml
opencv-python-rolling-release	Real	opencv-python-rolling opencv-contrib-python-rolling opencv-python-headless-rolling opencv-contrib-python-headless-rolling	build_wheels_macos.yml build_wheels_macos_m1.yml build_wheels_manylinux.yml build_wheels_windows.yml

Resolves #1110

[EpicWink]

Failing tests seem unrelated (due to misusing NumPy single-value arrays as scalars)

[Mukller]

Solid migration overall — dropping username/password secrets for OIDC trusted publishing, keeping the [^h]* glob distinction between opencv-python-* wheels and the opencv-python-*.tar.gz sdist, and splitting per-package dist-* directories so each project only receives its own artifacts. The README update is appreciated too.

One operational gap worth closing before this merges, because it will otherwise surface as a failed release upload:

Trusted publishing is configured per project (and per workflow filename), not per environment. The PR description asks maintainers to configure publishers for two/three environments, but on PyPI each of the four packages needs its own pending-publisher entry pointing at this repo:

Index	Projects
PyPI	opencv-python, opencv-contrib-python, opencv-python-headless, opencv-contrib-python-headless, plus the same four -rolling variants
TestPyPI	the four base names

That's 8 entries on PyPI + 4 on TestPyPI. Additionally, the publisher record pins the workflow filename, and here the publish steps live in four different files (build_wheels_macos.yml, build_wheels_macos_m1.yml, build_wheels_manylinux.yml, build_wheels_windows.yml) — each project may need multiple pending-publisher rows (one per workflow file) unless the matrix is spelled out explicitly.

Two suggestions:

1. Extend the maintainer checklist in the PR description into the full enumeration (or a table) so nothing is missed at release time.
2. Consider consolidating publishing into a single dedicated workflow (a publish job that downloads the wheel artifacts from the four build workflows via needs:/artifacts). That reduces the trusted-publisher configuration to one workflow filename per project and removes four copies of the near-identical upload boilerplate.

[EpicWink]

@Mukller

Consider consolidating publishing into a single dedicated workflow (a publish job that downloads the wheel artifacts from the four build workflows via needs:/artifacts). That reduces the trusted-publisher configuration to one workflow filename per project and removes four copies of the near-identical upload boilerplate.

Having the publish be a separate workflow (from building) makes auditing harder, complicating the chain of provenance.

I suggest combining the workflows into one file. This is sensible as they all do effectively the same thing (build, test, pre-release, release rolling, release), only in different environments. I've done this in #1265