ci: Use trusted publishers for publishing to PyPI #353
Conversation
* Use the OpenID Connect (OIDC) standard to publish to PyPI using PyPI's "Trusted Publisher" implementation to publish without using API tokens stored as GitHub Actions secrets. - c.f. https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/ - c.f. https://docs.pypi.org/trusted-publishers/
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## 3.0_develop #353 +/- ##
============================================
Coverage 79.89% 79.89%
============================================
Files 41 41
Lines 2253 2253
============================================
Hits 1800 1800
Misses 453 453
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
| # Mandatory for publishing with a trusted publisher | ||
| # c.f. https://docs.pypi.org/trusted-publishers/using-a-publisher/ | ||
| permissions: | ||
| id-token: write |
There was a problem hiding this comment.
Here I have not added the strongly encouraged recommendation of adding a specific release environment (would be done under https://github.com/ssl-hep/ServiceX_frontend/settings/environments) as I wanted to run this past the dev team first. If this is of interest, I can add it in and explain any questions people have.
|
@BenGalewsky @gordonwatts @ponyisi This is ready for review. Though not something that needs to be rushed, as I know we're all busy today. |
BenGalewsky
left a comment
BenGalewsky
left a comment
There was a problem hiding this comment.
Welcome to the future! So grateful for your dedication to the scientific python ecosystem.
Just make an issue for switching to environments. I think there could be a few complexities there for our current workflow
2 participants
For a full example (with lots of discussion) c.f. scikit-hep/pyhf#2183
For a concise summary, c.f. the Scientific Python Developer Guide section on this.
What is required of a maintainer for this to work