mirror of
https://github.com/linkedin/Liger-Kernel.git
synced 2026-10-12 02:17:47 +00:00
19d92e7309
## Summary - publish `liger-cute-kernels` through PyPI Trusted Publishing instead of long-lived username/password secrets - bind the publish job to the `liger-cute-kernels` GitHub environment configured in the pending publisher - grant `id-token: write` only to the publish job - use the PyPA-supported `pypa/gh-action-pypi-publish` action - retain the guarded manual `publish=true` retry added by #1473 ## Pending publisher configuration The PyPI pending publisher must exactly match: ```text Project: liger-cute-kernels GitHub owner: linkedin Repository: Liger-Kernel Workflow: publish-liger-cute-kernels.yml Environment: liger-cute-kernels ``` A pending publisher intentionally returns 404 for the project until its first successful OIDC upload. That first upload creates the project and associates it with the PyPI account that configured the pending publisher. ## Publishing 0.8.3 after merge Run **Build and Publish Liger Cute Kernels** manually on `main` with `publish=true`. The workflow rebuilds and validates both cores, packages the combined wheel, obtains a short-lived token through GitHub OIDC, and uploads it to PyPI. `PYPI_LCK_USERNAME` and `PYPI_LCK_PASSWORD` are not used by this workflow and can be removed after the OIDC path succeeds. ## Validation - workflow YAML parses successfully - publish job uses environment `liger-cute-kernels` - `id-token: write` is scoped to the publish job - no Twine username/password secrets are referenced - nightly and default manual builds remain non-publishing Co-authored-by: jkolehma <[email protected]> Co-authored-by: Copilot <[email protected]>