From 8ff20e1cd2713c2e0cfd08ab12cb58863ec7c7ef Mon Sep 17 00:00:00 2001 From: Kyle Barron Date: Mon, 5 Oct 2026 16:34:04 -0500 Subject: [PATCH] ci: Publish to PyPI with trusted publishing Replace the long-lived `PYPI_PASSWORD` API token with PyPI trusted publishing (OIDC), so no PyPI credentials are stored in the repo. Uploads run in a `pypi-release` environment, which can require approval before a release goes out, and only on tag pushes. Use the `release/v1` branch of gh-action-pypi-publish instead of `master`, and build the sdist with uv instead of setup-python + build. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-wheels.yml | 34 +++++++++++++++--------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/build-wheels.yml b/.github/workflows/build-wheels.yml index 991ef41..5c15127 100644 --- a/.github/workflows/build-wheels.yml +++ b/.github/workflows/build-wheels.yml @@ -32,37 +32,37 @@ jobs: name: Build source distribution runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: actions/setup-python@v2 - name: Install Python + - name: Install a specific version of uv + uses: astral-sh/setup-uv@v10.2.0 with: - python-version: "3.12" - - - name: Install dependencies - run: | - python -m pip install numpy Cython build + version: "latest" - name: Build sdist - run: python -m build --sdist + run: uv build --sdist - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 with: name: sdist path: dist/*.tar.gz upload_pypi: + name: Upload release to PyPI needs: [build_wheels, build_sdist] runs-on: ubuntu-latest - if: startsWith(github.ref, 'refs/tags/') + if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/') + environment: + # Note: this environment must be configured in the repo settings + name: pypi-release + url: https://pypi.org/p/quantized-mesh-encoder + permissions: + id-token: write # IMPORTANT: this permission is mandatory for trusted publishing steps: - - uses: actions/download-artifact@v4 + - uses: actions/download-artifact@v8 with: path: dist merge-multiple: true - - uses: pypa/gh-action-pypi-publish@master - with: - user: __token__ - password: ${{ secrets.PYPI_PASSWORD }} - # To test: repository_url: https://test.pypi.org/legacy/ + - name: Publish package distributions to PyPI + uses: pypa/gh-action-pypi-publish@release/v1