pytest-dev / pytest-dev/pytest-asyncio
Investigate replacing API token with Trusted Publisher configuration
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 207
- Avg merge
- 5h 35m
- Merged PRs (30d)
- 9
Description
The PyPI Upload step in the Deploy job of the CI pipeline currently uses an API token to upload packages to PyPI. The CI step emits the following warning:
Warning: Trusted Publishers allows publishing packages to PyPI from automated environments like GitHub Actions without needing to use username/password combinations or API tokens to authenticate with PyPI. Read more: https://docs.pypi.org/trusted-publishers
It is to be decided whether the API token should be kept or PyPI should be configure to trust the GitHub OIDC token, instead.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the CI pipeline's Deploy job and its PyPI Upload step, then review the linked PyPI Trusted Publishers guidance and the current API-token setup. Done means deciding between the existing token and GitHub OIDC trust, with the chosen publishing configuration applied or the decision documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, python
- Domain
- ci-cd, release, security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100