ci: publish to PyPI with OIDC Trusted Publishing (#2646)

* ci: publish to PyPI with OIDC Trusted Publishing Replace the long-lived PYPI_PASSWORD token with GitHub Actions OIDC and pypa/gh-action-pypi-publish on release publish events. Co-authored-by: Cursor <[email protected]> * ci: drop inline comment on id-token permission Co-authored-by: Cursor <[email protected]> --------- Co-authored-by: Cursor <[email protected]>
2026-10-11 22:50:09 +00:00 · 2026-08-09 23:14:01 -07:00
parent fe882bf0dc
commit 3f48c5deb5
1 changed files with 9 additions and 10 deletions
@@ -2,15 +2,17 @@ name: Upload Python Package

 on:
  release:
-    types: [created]
+    types: [published]

 permissions:
  contents: read

 jobs:
  deploy:
-
    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read

    steps:
    - uses: actions/checkout@v7
@@ -18,14 +20,11 @@ jobs:
      uses: actions/setup-python@v7
      with:
        python-version: '3.x'
-    - name: Install dependencies
+    - name: Install Poetry
      run: |
        python -m pip install --upgrade pip
        pip install poetry==1.8.4
-    - name: Build and publish
-      env:
-        PYPI_TOKEN: ${{ secrets.PYPI_PASSWORD }}
-      run: |
-        poetry config pypi-token.pypi ${PYPI_TOKEN}
-        poetry build
-        poetry publish
+    - name: Build package
+      run: poetry build
+    - name: Publish to PyPI
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2