ci: switch to PyPI Trusted Publishing (OIDC)

[ad-m]

Summary

• Replace API token-based PyPI authentication with OpenID Connect (OIDC) Trusted Publishing
• Separate build and publish into distinct jobs for better security (build artifacts are uploaded/downloaded between jobs)
• Pin actions to latest stable versions (actions/checkout@v4, actions/setup-python@v5, pypa/gh-action-pypi-publish@release/v1)
• Trigger only on tag pushes (previously triggered on all pushes, with tag condition only on the publish step)
• Use python -m build instead of setup.py sdist bdist_wheel

Manual setup steps required

Before this workflow will work, the following manual configuration is needed:

1. Create GitHub Environments

In the repository Settings > Environments, create two environments:

• pypi - for publishing to production PyPI
• testpypi - for publishing to Test PyPI

2. Configure Trusted Publishers on PyPI

On PyPI:

1. Go to Manage > Publishing for the python-anticaptcha project
2. Add a new GitHub publisher with:
   • Owner: ad-m
   • Repository: python-anticaptcha
   • Workflow name: publish.yml
   • Environment name: pypi

3. Configure Trusted Publishers on TestPyPI

On TestPyPI:

1. Same as above but with environment name: testpypi

4. Remove old secrets

Once trusted publishing is verified working, remove the now-unused repository secrets:

• pypi_password
• test_pypi_password

Recommended hardening

• Add environment protection rules: In each GitHub environment's settings, add deployment protection rules such as required reviewers, so that publish jobs require manual approval before running
• Restrict environment to tags only: Under each environment, set Deployment branches and tags to "Selected branches and tags" and add a rule matching only tags (e.g., v* or *) to prevent accidental publishes from branches
• Enable branch protection on master: Require pull request reviews and status checks before merging, to prevent unauthorized tag creation
• Consider adding tag protection rules: Under Settings > Tags, add a tag protection rule (e.g., v*) so only maintainers can create release tags
• Pin the publish action to a commit SHA instead of release/v1 for even stronger supply-chain security (e.g., pypa/gh-action-pypi-publish@<full-sha>)
• Enable Sigstore signing: pypa/gh-action-pypi-publish supports attestations via Sigstore; consider enabling attestations: true for additional package provenance

Test plan

• Create GitHub environments (pypi, testpypi) as described above
• Configure trusted publishers on PyPI and TestPyPI
• Create a test tag and verify the workflow publishes to TestPyPI
• Verify the workflow publishes to production PyPI
• Remove old pypi_password and test_pypi_password secrets

Generated with Claude Code