From 3a57a231211ef364f9c37b09b38ff2f014e6121b Mon Sep 17 00:00:00 2001 From: Joon-Yee Chuah Date: Fri, 24 Jul 2026 10:59:28 -0500 Subject: [PATCH] IT-6150: publish to PyPI via OIDC trusted publishing Replace token-based twine upload with pypa/gh-action-pypi-publish using GitHub Actions OIDC. Adds id-token: write permission and the pypi environment; removes the PYPI_USERNAME/PYPI_PASSWORD secrets usage. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/publish-on-pypi.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish-on-pypi.yml b/.github/workflows/publish-on-pypi.yml index d5279d1d..ea049a69 100644 --- a/.github/workflows/publish-on-pypi.yml +++ b/.github/workflows/publish-on-pypi.yml @@ -8,6 +8,9 @@ on: jobs: build-and-upload: runs-on: ubuntu-latest + environment: pypi + permissions: + id-token: write steps: - name: Check out the release commit @@ -22,10 +25,8 @@ jobs: - name: Build sdist and wheel run: | python -m build - - name: Publish to PyPI - env: - TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }} - TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }} + - name: Check the distribution run: | python -m twine check --strict dist/* - python -m twine upload dist/* + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1