From 3f48c5deb57e5df4c6a507d111da956fcdd535d1 Mon Sep 17 00:00:00 2001 From: Ajin Abraham Date: Sun, 9 Aug 2026 23:14:01 -0700 Subject: [PATCH] ci: publish to PyPI with OIDC Trusted Publishing (#2646) * ci: publish to PyPI with OIDC Trusted Publishing Replace the long-lived PYPI_PASSWORD token with GitHub Actions OIDC and pypa/gh-action-pypi-publish on release publish events. Co-authored-by: Cursor * ci: drop inline comment on id-token permission Co-authored-by: Cursor --------- Co-authored-by: Cursor --- .github/workflows/python-publish.yml | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index 24092d11..46ac9c12 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -2,15 +2,17 @@ name: Upload Python Package on: release: - types: [created] + types: [published] permissions: contents: read jobs: deploy: - runs-on: ubuntu-latest + permissions: + id-token: write + contents: read steps: - uses: actions/checkout@v7 @@ -18,14 +20,11 @@ jobs: uses: actions/setup-python@v7 with: python-version: '3.x' - - name: Install dependencies + - name: Install Poetry run: | python -m pip install --upgrade pip pip install poetry==1.8.4 - - name: Build and publish - env: - PYPI_TOKEN: ${{ secrets.PYPI_PASSWORD }} - run: | - poetry config pypi-token.pypi ${PYPI_TOKEN} - poetry build - poetry publish + - name: Build package + run: poetry build + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2