Skip to content

Commit 7916e4a

Browse files
Upgrade PyPI upload workflow to use Trusted Publishing (psf#4589) (psf#4611)
* Upgrade PyPI upload workflow to use Trusted Publishing * Add changelog entry for PyPI Trusted Publishing upgrade * Added PR number for changelog CI --------- Co-authored-by: Cooper Lees <[email protected]>
1 parent 6426151 commit 7916e4a

File tree

2 files changed

+21
-10
lines changed

2 files changed

+21
-10
lines changed

.github/workflows/pypi_upload.yml

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,16 @@ on:
1010

1111
permissions:
1212
contents: read
13+
id-token: write # Required for PyPI trusted publishing
1314

1415
jobs:
1516
main:
1617
name: sdist + pure wheel
1718
runs-on: ubuntu-latest
1819
if: github.event_name == 'release'
20+
environment:
21+
name: release
22+
url: https://pypi.org/p/black
1923

2024
steps:
2125
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -28,19 +32,19 @@ jobs:
2832
python-version: "3.13"
2933
allow-prereleases: true
3034

31-
- name: Install latest pip, build, twine
35+
- name: Install latest pip, build
3236
run: |
3337
python -m pip install --upgrade --disable-pip-version-check pip
34-
python -m pip install --upgrade build twine
38+
python -m pip install --upgrade build
3539
3640
- name: Build wheel and source distributions
3741
run: python -m build
3842

3943
- if: github.event_name == 'release'
40-
name: Upload to PyPI via Twine
41-
env:
42-
TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
43-
run: twine upload --verbose -u '__token__' dist/*
44+
name: Publish package distributions to PyPI
45+
uses: pypa/gh-action-pypi-publish@release/v1
46+
with:
47+
verbose: true
4448

4549
generate_wheels_matrix:
4650
name: generate wheels matrix
@@ -91,6 +95,10 @@ jobs:
9195
name: mypyc wheels ${{ matrix.only }}
9296
needs: generate_wheels_matrix
9397
runs-on: ${{ matrix.os }}
98+
if: github.event_name == 'release'
99+
environment:
100+
name: release
101+
url: https://pypi.org/p/black
94102
strategy:
95103
fail-fast: false
96104
matrix:
@@ -112,10 +120,11 @@ jobs:
112120
path: ./wheelhouse/*.whl
113121

114122
- if: github.event_name == 'release'
115-
name: Upload wheels to PyPI via Twine
116-
env:
117-
TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
118-
run: pipx run twine upload --verbose -u '__token__' wheelhouse/*.whl
123+
name: Publish package distributions to PyPI
124+
uses: pypa/gh-action-pypi-publish@release/v1
125+
with:
126+
packages-dir: wheelhouse/
127+
verbose: true
119128

120129
update-stable-branch:
121130
name: Update stable branch

CHANGES.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@
4545

4646
<!-- For example, Docker, GitHub Actions, pre-commit, editors -->
4747

48+
- Upgraded PyPI upload workflow to use Trusted Publishing (#4611)
49+
4850
### Documentation
4951

5052
<!-- Major changes to documentation and policies. Small docs changes

0 commit comments

Comments
 (0)