PyPI Attestations

[jspeed-meyers]

https://blog.pypi.org/posts/2024-11-14-pypi-now-supports-digital-attestations/

Does the publish action version need to be bumped? Or should this "just work"?

[jspeed-meyers]

The documentation says:

The generation and publication of attestations happens by default, and no changes are necessary for projects that meet all of these conditions:

• publish from GitHub Actions;
• via Trusted Publishing; and
• use the pypa/gh-action-pypi-publish action to publish.

1 and 3 are satisfied. But is 2?

[jspeed-meyers]

I don't think 2 is satisfied. I think that I need to enter some information manually via the PyPI interface for this project. See https://docs.pypi.org/trusted-publishers/adding-a-publisher/

[jspeed-meyers]

Okay, I think 2 is satisfied now. (I just clicked some buttons.) After the next release, I'll check PyPI. If it looks good to go, I'll close this.