ci: PyPI Trusted Publisher + workflow cleanup#182
Merged
Conversation
piitaya
changed the title
piitaya
changed the title
Owner
|
Looks like the pypi side was already done and pending. Any option to keep this auto though within github? Right now since I have to merge items or those I trust releases are protected. |
- ci.yml: pull_request_target -> pull_request (security), drop unused flake8 + CDNNINJA_* secrets, Python matrix 3.10-3.13, run on master too - publish.yml: pin Python 3.12, align setup-python@v6 - release.yml: add concurrency, replace deprecated create-release@v1 with gh release create, drop ad-m/github-push-action, hoist if to one combined step
piitaya
changed the title
Collaborator
Author
|
@cdnninja I changed the workflow to use automatic releases (same as before) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Move PyPI publishing to Trusted Publisher (OIDC) instead of the static token, and tidy up the rest of the workflows on the way.
release.ymlkeeps doing the auto-bump on push to master. The only change is replacing the deprecatedactions/create-release@v1with agh release createcall.publish.ymlis new. It fires when a GitHub release is published, builds the wheel, and pushes it to PyPI using the OIDC trusted publisher you set up earlier. Build and publish run as two separate jobs so the publish step is the only one with theid-tokenpermission.ci.ymlhadpull_request_targetchecking out the PR head, which is unsafe with forks (the workflow runs with repo secrets in scope). Switched to plainpull_request. Also dropped the unusedflake8step andCDNNINJA_*secrets, and bumped the Python matrix to 3.10-3.13.Release flow
Nothing changes on your side. Merge a PR with a conventional title (
feat:,fix:,feat!:),release.ymltags and creates the release,publish.ymlships it to PyPI.Notes
The
pypiGitHub Environment gets auto-created on the first publish run. Once that run succeeds you can delete thePYPI_API_TOKENandPYPI_API_TESTsecrets.