From 5f12d30402470c738c5e4ef84bf1493ee2f13e6d Mon Sep 17 00:00:00 2001 From: Artur Shiriev Date: Wed, 1 Jul 2026 20:58:13 +0300 Subject: [PATCH] ci: publish to PyPI via Trusted Publishing (OIDC) Drop the long-lived PYPI_TOKEN secret in favor of OIDC. uv publish auto-detects the GitHub Actions id-token, so the release job grants id-token: write and runs under a `pypi` environment that scopes the PyPI Trusted Publisher. Requires a matching Trusted Publisher on the modern-di PyPI project (workflow: release.yml, environment: pypi) before the next tag. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 8 +++++--- Justfile | 3 ++- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 14e19d0..7282d60 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,13 +11,15 @@ on: - '[0-9]+.[0-9]+.[0-9]+' # stable: 2.7.2 - '[0-9]+.[0-9]+.[0-9]+[a-z]+[0-9]+' # pre-release: 2.0.0rc1, 4.0.0a2 -# Needed for softprops/action-gh-release to create the GitHub Release. +# contents: write -> create the GitHub Release; id-token: write -> OIDC for PyPI Trusted Publishing. permissions: contents: write + id-token: write jobs: release: runs-on: ubuntu-latest + environment: pypi # scopes the PyPI Trusted Publisher; hook for approval rules steps: - uses: actions/checkout@v6 - uses: extractions/setup-just@v4 @@ -45,9 +47,9 @@ jobs: # PyPI is irreversible, so it runs FIRST: if it fails the job stops and no # GitHub Release is created advertising a version that never reached PyPI. # `just publish` derives the version from $GITHUB_REF_NAME (the tag name). + # Auth via PyPI Trusted Publishing (OIDC); no PYPI_TOKEN. Needs a Trusted + # Publisher on the modern-di PyPI project (env: pypi, workflow: release.yml). - run: just publish - env: - PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }} # Description source: planning/releases/.md if present (verbatim, no # auto-changelog appended); otherwise GitHub's generated notes. The guard diff --git a/Justfile b/Justfile index 45a8ef6..1108825 100644 --- a/Justfile +++ b/Justfile @@ -37,11 +37,12 @@ bench: uv run --no-sync pytest benchmarks/ --benchmark-only # Build + publish to PyPI. Version comes from the git tag ($GITHUB_REF_NAME); no pyproject bump. +# Auth via PyPI Trusted Publishing (OIDC); uv publish auto-detects the CI id-token. publish: rm -rf dist uv version $GITHUB_REF_NAME uv build - uv publish --token $PYPI_TOKEN + uv publish # Build the docs site, failing on broken links / nav warnings; CI runs this on every PR. docs-build: