Update the workflow configs to use OIDC token

achimnol · May 4, 2023 · 23360b4 · 23360b4
1 parent e7b230a
commit 23360b4
Showing 1 changed file with 20 additions and 6 deletions.
diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
@@ -112,8 +112,11 @@ jobs:
     if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     environment: deploy-to-pypi
+    permissions:
+      id-token: write
     steps:
-    - uses: actions/checkout@v3
+    - name: Checkout sources
+      uses: actions/checkout@v3
     - name: Set up Python
       uses: actions/setup-python@v3
       with:
@@ -122,12 +125,23 @@ jobs:
         cache-dependency-path: |
           requirements/build.txt
     - name: Install dependencies
-      env:
-        REQUIREMENTS_FILE: build
       run: |
-        python -m pip install -U pip setuptools wheel
+        python -m pip install -U pip setuptools
         pip install -U -r requirements/build.txt
-    - name: Build and publish
+    - name: Build sdist and wheel
       run: |
         python -m build -s -w
-        twine upload dist/*
+    - name: Mint API token
+      id: mint-token
+      run: |
+        resp=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+          "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=pypi")
+        oidc_token=$(jq '.value' <<< "${resp}")
+        resp=$(curl -X POST https://pypi.org/_/oidc/github/mint-token -d "{\"token\": \"${oidc_token}\"}")
+        api_token=$(jq '.token' <<< "${resp}")
+        echo "::add-mask::${api_token}"
+        echo "api-token=${api_token}" >> "${GITHUB_OUTPUT}"
+    - name: Publish
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        password: ${{ steps.mint-token.outputs.api-token }}