From 8222dce93c775676198728946d954d45b7480c1e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Bidoul?= Date: Sat, 4 Apr 2026 14:10:16 +0200 Subject: [PATCH] Use PyPI trusted publishing --- .github/workflows/publish.yml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 23c9a7d..37b3cae 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -3,20 +3,26 @@ name: Publish on: push: tags: + - "*" jobs: publish: + name: Upload release to PyPI runs-on: ubuntu-latest + environment: + name: pypi + url: https://pypi.org/p/openupgradelib + permissions: + id-token: write # IMPORTANT: this permission is mandatory for trusted publishing if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags') steps: - - uses: actions/checkout@v2 - - uses: actions/setup-python@v2 + - uses: actions/checkout@v4 + with: + persist-credentials: false + - uses: actions/setup-python@v5 - name: Install pypa/build run: python -m pip install build - name: Build a binary wheel and a source tarball run: python -m build - name: Publish package to PyPI uses: pypa/gh-action-pypi-publish@release/v1 - with: - user: __token__ - password: ${{ secrets.pypi_token }}