From f78605cf2c3f2fb6323f4d614788123a05b5cd1a Mon Sep 17 00:00:00 2001 From: icepaq Date: Sat, 22 Aug 2026 00:59:24 -0700 Subject: [PATCH] fix: publish to PyPI with the token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Trusted publishing was never configured on the PyPI project, so the 1.0.11 release built cleanly and then failed at the upload with no publisher matching its OIDC claims. The repo already holds a PYPI_TOKEN secret, so use it. The token stays confined to the publish job, which installs nothing and only uploads the artifact the build job produced — the id-token permission is gone since nothing needs it now. A preflight fails fast with a clear message if the secret is ever missing, rather than after a full build. Co-Authored-By: Claude Fable 5 --- .github/workflows/publish-main.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-main.yml b/.github/workflows/publish-main.yml index 971b1231..6bd69d01 100644 --- a/.github/workflows/publish-main.yml +++ b/.github/workflows/publish-main.yml @@ -238,18 +238,27 @@ jobs: needs: [decide, build] if: needs.decide.outputs.release == 'true' && needs.decide.outputs.dry == 'false' runs-on: ubuntu-latest - permissions: - id-token: write steps: - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dist path: dist/ + - name: Check the token is present + env: + PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }} + run: | + set -euo pipefail + if [ -z "${PYPI_TOKEN:-}" ]; then + echo "::error::PYPI_TOKEN is not set on this repository; the upload would fail after the build." + exit 1 + fi + - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: packages-dir: dist/ print-hash: true + password: ${{ secrets.PYPI_TOKEN }} tag: needs: [decide, build, publish]