moving to trusted publishing for pypi

eclipse-sumo · Dec 31, 2023 · e339d27 · e339d27
1 parent 6159910
commit e339d27
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 9 deletions.
diff --git a/.github/workflows/wheel-linux.yml b/.github/workflows/wheel-linux.yml
@@ -66,6 +66,9 @@ jobs:
         name: manylinux-wheels
         path: wheelhouse
 
+  ###################
+  # testing wheels
+  ###################
   test-wheels:
     needs: [build-manylinux-wheels]
     runs-on: ubuntu-latest
@@ -126,10 +129,15 @@ jobs:
         path: texttesttmp.zip
         if-no-files-found: warn
 
+  ###################
+  # publishing wheels
+  ###################
   publish-wheels:
     if: github.repository == 'eclipse-sumo/sumo' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags'))
     needs: [test-wheels]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
 
     steps:
     - name: Downloading Wheels artifact
@@ -138,14 +146,12 @@ jobs:
     - name: Publish to Test PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        password: ${{ secrets.TEST_PYPI_TOKEN }}
+        packages-dir: manylinux-wheels/
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true
-        packages-dir: manylinux-wheels/
 
     - name: Publish to PyPI
       if: startsWith(github.ref, 'refs/tags')
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        password: ${{ secrets.PYPI_TOKEN }}
         packages-dir: manylinux-wheels/
diff --git a/.github/workflows/wheel-macos.yml b/.github/workflows/wheel-macos.yml
@@ -72,6 +72,9 @@ jobs:
         name: python-wheels
         path: dist
 
+  ###################
+  # testing wheels
+  ###################
   test-wheels:
     needs: [build-wheels]
     strategy:
@@ -152,25 +155,28 @@ jobs:
         path: texttesttmp.zip
         if-no-files-found: warn
 
+  ###################
+  # publishing wheels
+  ###################
   publish-wheels:
     if: github.repository == 'eclipse-sumo/sumo' && (github.event_name == 'schedule' || startsWith(github.ref, 'refs/tags'))
     needs: [test-wheels]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
 
     steps:
     - uses: actions/download-artifact@v3
 
     - name: Publish to Test PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        password: ${{ secrets.TEST_PYPI_TOKEN }}
+        packages-dir: python-wheels/
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true
-        packages-dir: python-wheels/
 
     - name: Publish to PyPI
       if: startsWith(github.ref, 'refs/tags')
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        password: ${{ secrets.PYPI_TOKEN }}
         packages-dir: python-wheels/
diff --git a/.github/workflows/wheel-windows.yml b/.github/workflows/wheel-windows.yml
@@ -191,6 +191,8 @@ jobs:
     if: github.repository == 'eclipse-sumo/sumo' && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags'))
     needs: [test-wheels]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
 
     steps:
     - uses: actions/download-artifact@v3
@@ -206,12 +208,9 @@ jobs:
     - name: Publish to Test PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        password: ${{ secrets.TEST_PYPI_TOKEN }}
         repository-url: https://test.pypi.org/legacy/
         skip-existing: true
 
     - name: Publish to PyPI
       if: startsWith(github.ref, 'refs/tags')
       uses: pypa/gh-action-pypi-publish@release/v1
-      with:
-        password: ${{ secrets.PYPI_TOKEN }}