From 98526482b2b968d226084145c0e201dd173da664 Mon Sep 17 00:00:00 2001 From: Artur Shiriev Date: Wed, 1 Jul 2026 21:13:02 +0300 Subject: [PATCH] ci: publish to PyPI via Trusted Publishing (OIDC) Drop the long-lived PYPI_TOKEN secret in favor of OIDC. uv publish auto-detects the GitHub Actions id-token, so the release job grants id-token: write and runs under a `pypi` environment that scopes the PyPI Trusted Publisher. Requires a matching Trusted Publisher on the modern-di-fastapi PyPI project (workflow: release.yml, environment: pypi) before the next tag. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 8 +++++--- Justfile | 3 ++- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ef3c93e..ba86c0a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,13 +11,15 @@ on: - '[0-9]+.[0-9]+.[0-9]+' # stable: 2.7.2 - '[0-9]+.[0-9]+.[0-9]+[a-z]+[0-9]+' # pre-release: 2.0.0rc1, 4.0.0a2 -# Needed for softprops/action-gh-release to create the GitHub Release. +# contents: write -> create the GitHub Release; id-token: write -> OIDC for PyPI Trusted Publishing. permissions: contents: write + id-token: write jobs: release: runs-on: ubuntu-latest + environment: pypi # scopes the PyPI Trusted Publisher; hook for approval rules steps: - uses: actions/checkout@v6 - uses: extractions/setup-just@v4 @@ -26,9 +28,9 @@ jobs: # PyPI is irreversible, so it runs FIRST: if it fails the job stops and no # GitHub Release is created advertising a version that never reached PyPI. # `just publish` derives the version from $GITHUB_REF_NAME (the tag name). + # Auth via PyPI Trusted Publishing (OIDC); no PYPI_TOKEN. Needs a Trusted + # Publisher on the modern-di-fastapi PyPI project (env: pypi, workflow: release.yml). - run: just publish - env: - PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }} # Description source: planning/releases/.md if present (verbatim, no # auto-changelog appended); otherwise GitHub's generated notes. A tag with diff --git a/Justfile b/Justfile index 498be36..e9c010c 100644 --- a/Justfile +++ b/Justfile @@ -32,8 +32,9 @@ test-ci: test-branch: uv run --no-sync pytest --cov=. --cov-branch --cov-fail-under=100 +# Auth via PyPI Trusted Publishing (OIDC); uv publish auto-detects the CI id-token. publish: rm -rf dist uv version $GITHUB_REF_NAME uv build - uv publish --token $PYPI_TOKEN + uv publish