Convert to trusted publishing - #62
Merged
Merged
Conversation
I based this change on the official PyPI documentation: https://docs.pypi.org/trusted-publishers/ as well as a blog post walking through an example of how to implement trusted publishing for a Python project: https://pgjones.dev/blog/trusted-plublishing-2023/ The diff is fairly minimal. All it does is remove the password used to authenticate to PyPI, which we don't need anymore, and add a permission needed for trusted publishing to operate. This commit will be accompanied by some configuration in the project settings on PyPI to allow this specific workflow to act as a trusted publisher. Effectively, we're telling PyPI that when this particular workflow (`publish.yml`) contacts it with an OIDC token from Github, then PyPI should accept that as valid authentication and return an API token which can be used to actually upload a package.
RonnyPfannschmidt
approved these changes
May 21, 2023
RonnyPfannschmidt
left a comment
RonnyPfannschmidt
left a comment
Member
There was a problem hiding this comment.
Feel free to do this as soon as you like 👍
Contributor
Author
|
Whoops, forgot to do this yesterday, and I'm traveling for a few days... Since this is not urgent at all I'll finish it up when I get back |
Contributor
Author
|
I made the configuration changes in both pypi and test-pypi and confirmed that deployment of a dummy release to test-pypi works, so I'll merge this now. We should make sure to have at least one prerelease of the next final release (0.8, probably) in order to catch any problems with deploying to pypi before the final release goes live. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I based this change on the official PyPI documentation as well as a blog post walking through an example of how to implement trusted publishing for a Python project.
The diff is fairly minimal. All it does is remove the password used to authenticate to PyPI, which we don't need anymore, and add a permission needed for trusted publishing to operate.
This commit will be accompanied by some configuration in the project settings on PyPI to allow this specific workflow to act as a trusted publisher. Specifically, I'm going to add a trusted publisher with the following settings:
pytest-devpytest-localserverrelease.ymlpypiand on Test PyPI I'm going to do the same except using
test-pypias the environment. I'll make those changes in a couple days, as long as no objections are raised before then, and then I'll try creating a test release and publishing it to Test PyPI (not regular PyPI) before merging this PR so I can make sure the flow works. After I've successfully published a release to both Test PyPI and regular PyPI - that will presumably be release 0.8 - I'll remove the secret tokens from both thepypiandtest-pypienvironments in this Github project.Resolves #61