Applying Trusted Publisher

まだ誰も着手していません。

Applying Trusted Publisher to your PyPI projects is strongly recommended for the following reasons:

- **Improved usability**: Eliminates the manual creation and management of long-lived API tokens by leveraging OpenID Connect (OIDC) in your CI workflows, streamlining release automation and reducing human error in token handling .
- **Enhanced security**: Short-lived tokens (valid for a maximum of 15 minutes) drastically limit the attack window for credential theft, mitigating the risk of token leakage or unauthorized reuse
- **Elimination of secret storage**: You no longer need to store sensitive API tokens in environment variables or secret managers; OIDC tokens are issued on-demand and never persist beyond the publish operation
- **Fine-grained trust controls**: Configure which CI workflows or environments are allowed to publish, enabling least-privilege release setups and reducing the blast radius of any compromised workflow
- **Automatic token revocation**: Since tokens expire automatically, there is no need for manual revocation, ensuring that stale credentials cannot be exploited long after they were issued .

https://docs.pypi.org/trusted-publishers/

まず、リポジトリの CI リリースワークフローと、リンクされている PyPI Trusted Publishers のドキュメントを確認してください。公開時に、想定された信頼制御を備えた短期間有効な OIDC 認証情報が使用され、長期間有効な PyPI API token が不要になれば、作業は完了です。

索引モデルが issue の本文から書いたものです。