oracle / oracle/oci-python-sdk
Publish to PyPI with trusted publishing
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 474
- Forks
- 321
- Avg merge
- 23m
- Merged PRs (30d)
- 4
Description
Trusted publishing (with attestations) means I have high confidence that what I download from PyPI is the same artefact which was generated in GitHub CI, meaning that what I see in GitHub is the same as what is installed - handy for auditing.
This is instead of manually uploading via a local invocation of twine.
See the Python packaging documentation, the PyPI documentation, and the official pypi-publish GitHub action documentation on trusted publishing.
Implementation (using GitHub actions) (click to expand)
- Configure a GitHub CI workflow for publishing the package to PyPI, with package build and publish jobs
- Configure (or use an existing) GitHub environment, and register with PyPI
- Add the environment definition to the publish job
- Add
id-token: writeandcontents: readpermissions to the same publish job
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the repository's existing GitHub Actions workflows and the linked Python packaging, PyPI trusted-publishers, and pypa/gh-action-pypi-publish documentation. Configure the package build and publish jobs, the GitHub environment, and the stated permissions for trusted publishing with attestations. Done means releases publish from GitHub CI without a local twine upload and the generated artifact can be verified on PyPI.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, python
- Domain
- ci-cd, release
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100