publish.yml: use trusted publishing instead of API token #2549
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Seems like this should be fine, although I'd appreciate an extra pair of eyes on this if anyone has the time. After merging, I'll get Trusted Publishing set up on the PyPI side and decommission the API token we've been using. |
PR looks good to me. Might as well do the change now -- just make a pre-release subsequently as a test. |
|
In reviewing this I stumbled across https://github.com/hynek/build-and-inspect-python-package which is less helpful for the publishing changes in this PR but may be worth considering all at once for the building/testing/report aspects. |
wholmgren
approved these changes
Sep 22, 2025
This was referenced Sep 23, 2025
Merged
|
Following up: it worked as expected when testing with v0.13.1a1 👍 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
docs/sphinx/source/whatsnewfor all changes. Includes link to the GitHub Issue with:issue:`num`or this Pull Request with:pull:`num`. Includes contributor name and/or GitHub username (link with:ghuser:`user`).remote-data) and Milestone are assigned to the Pull Request and linked Issue.This guide is helpful: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
I also separated the PyPI publishing portion to a separate job. This is so that the additional permissions required for Trusted Publishing are only accessible to the actual upload, not the build steps (which run often, on PRs). With separate steps, the dist files have to be stored as artifacts. I think that will also make them accessible for manual download as a job output if desired, which might be handy someday.