From 8320b79297712ae292ecf77df803329d203f62fd Mon Sep 17 00:00:00 2001 From: David Wright Date: Mon, 19 Feb 2024 10:52:55 -0800 Subject: [PATCH] Use "trusted publisher" from PyPI --- .github/workflows/publish_to_pypi.yaml | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/.github/workflows/publish_to_pypi.yaml b/.github/workflows/publish_to_pypi.yaml index ba51bcf2..389d21b0 100644 --- a/.github/workflows/publish_to_pypi.yaml +++ b/.github/workflows/publish_to_pypi.yaml @@ -27,13 +27,20 @@ jobs: - name: Build a binary wheel and a source tarball run: python -m build --sdist --wheel --outdir dist/ . - # - name: Publish distribution to Test PyPI - # uses: pypa/gh-action-pypi-publish@master - # with: - # password: ${{ secrets.TEST_PYPI_API_TOKEN }} - # repository_url: https://test.pypi.org/legacy/ - - - name: Publish distribution to PyPI - uses: pypa/gh-action-pypi-publish@master with: - password: ${{ secrets.PYPI_API_TOKEN }} + pypi-publish: + needs: ['build_wheels, make_sdist'] + environment: 'publish' + + name: upload release to PyPI + runs-on: ubuntu-latest + permissions: + # IMPORTANT: this permission is mandatory for trusted publishing + id-token: write + steps: + - uses: actions/download-artifact@v3 + + - name: Publish package distributions to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + with: + packages_dir: artifact/