diff options
Diffstat (limited to '.github/workflows/python-publish.yml')
| -rw-r--r-- | .github/workflows/python-publish.yml | 33 |
1 files changed, 15 insertions, 18 deletions
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index f47ac56..d832902 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -1,10 +1,7 @@ -# This workflow will upload a Python Package using Twine when a release is created -# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries - -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. +# Publishes the Python package to PyPI via Trusted Publishing (OIDC). +# No long-lived API token: PyPI verifies the GitHub Actions OIDC identity of +# this workflow. Configure the trusted publisher once in the PyPI project +# settings (owner: luciferreeves, repo: edify, workflow: python-publish.yml). name: Upload Python Package @@ -18,23 +15,23 @@ permissions: jobs: deploy: - runs-on: ubuntu-latest - + environment: + name: pypi + url: https://pypi.org/p/edify + permissions: + id-token: write steps: - - uses: actions/checkout@v5 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 + with: + fetch-depth: 0 - name: Set up Python uses: actions/setup-python@v5 with: python-version: '3.x' - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install build + - name: Install build backend + run: python -m pip install --upgrade pip build - name: Build package run: python -m build - - name: Publish package + - name: Publish package to PyPI via Trusted Publishing uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 - with: - user: __token__ - password: ${{ secrets.PYPI_API_TOKEN }} |