From 3a57a231211ef364f9c37b09b38ff2f014e6121b Mon Sep 17 00:00:00 2001 From: Joon-Yee Chuah Date: Fri, 24 Jul 2026 10:59:28 -0500 Subject: [PATCH 1/2] IT-6150: publish to PyPI via OIDC trusted publishing Replace token-based twine upload with pypa/gh-action-pypi-publish using GitHub Actions OIDC. Adds id-token: write permission and the pypi environment; removes the PYPI_USERNAME/PYPI_PASSWORD secrets usage. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/publish-on-pypi.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish-on-pypi.yml b/.github/workflows/publish-on-pypi.yml index d5279d1d..ea049a69 100644 --- a/.github/workflows/publish-on-pypi.yml +++ b/.github/workflows/publish-on-pypi.yml @@ -8,6 +8,9 @@ on: jobs: build-and-upload: runs-on: ubuntu-latest + environment: pypi + permissions: + id-token: write steps: - name: Check out the release commit @@ -22,10 +25,8 @@ jobs: - name: Build sdist and wheel run: | python -m build - - name: Publish to PyPI - env: - TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }} - TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }} + - name: Check the distribution run: | python -m twine check --strict dist/* - python -m twine upload dist/* + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1 From 2932cf17321dd1ce9d49e6eb8c60e77d7ee3f4dc Mon Sep 17 00:00:00 2001 From: Mark Dickinson Date: Mon, 27 Jul 2026 18:02:12 +0100 Subject: [PATCH 2/2] Add "contents: read" permission We need "contents: read" for the checkout action to succeed. It works implicitly at the moment because the repo is public, but both Claude and Copilot recommended making it explicit. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/publish-on-pypi.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/publish-on-pypi.yml b/.github/workflows/publish-on-pypi.yml index e9a971c3..2508004a 100644 --- a/.github/workflows/publish-on-pypi.yml +++ b/.github/workflows/publish-on-pypi.yml @@ -10,6 +10,7 @@ jobs: runs-on: ubuntu-latest environment: pypi permissions: + contents: read id-token: write steps: