[packaging] Publish to PyPI using Trusted Publishing
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 408
- Avg merge
- 2d 57m
- Merged PRs (30d)
- 7
Description
TL;DR this will allow dropping the API token as a repo secret, making use of OIDC to upload dists to PyPI and on top of that, said dists will get digital attestations that will also end up on PyPI.
Implementation instructions: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked Python Packaging User Guide section on GitHub Actions trusted publishing, then inspect this repository's release workflow and its current PyPI credentials. Done means releases use OIDC instead of a repository API-token secret and publish digital attestations to PyPI; verify the workflow configuration and release path accordingly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, python
- Domain
- ci-cd, release, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100