Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update release workflow to publish PyPI package as a Trusted Publisher #190

Merged
merged 3 commits into from
Apr 9, 2024

Conversation

blidd-google
Copy link
Collaborator

@blidd-google blidd-google commented Apr 9, 2024

Starting in 2024, PyPI requires all users to enable Two-Factor Authentication. This will consequently require all users to switch to either Trusted Publishers (preferred) or API tokens for package uploads. Read more: https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2fa/

Trusted Publishers allows publishing packages to PyPI from automated environments like GitHub Actions without needing to use username/password combinations or API tokens to authenticate with PyPI. Read more: https://docs.pypi.org/trusted-publishers

Following the steps documented at https://docs.pypi.org/trusted-publishers/adding-a-publisher/, I added the publish workflow as a trusted publisher in the Firebase PyPI account. This PR updates our release workflow to enable publishing to PyPI from the GitHub Actions automated environment, as per the steps documented here: https://docs.pypi.org/trusted-publishers/using-a-publisher/.

Copy link
Member

@inlined inlined left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’m honestly just stamping this one. I see no obvious mistakes, but I don’t know why the “v” prefix used to exist and is now removed, and I don’t know the nuances of release.yaml. If you’re confident in these changes, go ahead, but if you’re actually looking for a safety net, add on another reviewer

@blidd-google
Copy link
Collaborator Author

I believe the "v" prefix was copied over from the python admin SDK's release scripts, but we don't use it for our tags in the python functions SDK. Tested out the commands and they only run successfully when we omit the "v", as expected.

I also requested @lahirumaramba's review because they recently had to make this change too (firebase/firebase-admin-python#759). I may wait on that to minimize the risk of flubbing another release attempt.

@blidd-google blidd-google requested review from jonathanedey and removed request for dackers86, pr-Mais and exaby73 April 9, 2024 01:05
Copy link

@jonathanedey jonathanedey left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code and pypi settings LGTM!

@blidd-google blidd-google merged commit a9a7b47 into main Apr 9, 2024
10 checks passed
@blidd-google blidd-google mentioned this pull request Apr 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants