From ca375bb4c65d7bd21090980e23e4fbcb81c8cf29 Mon Sep 17 00:00:00 2001 From: Anthony Volk <14987227+anth-volk@users.noreply.github.com> Date: Mon, 12 Oct 2026 17:35:08 +0400 Subject: [PATCH 1/2] Publish to PyPI with trusted publishing Add environment: pypi and id-token: write to the job that runs pypa/gh-action-pypi-publish, and drop the user/password inputs that passed the org-wide secrets.PYPI token, so the upload uses OIDC. Add a changed fragment so merging cuts a patch release. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/push.yaml | 8 ++++++-- changelog.d/trusted-publishing.changed.md | 1 + 2 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 changelog.d/trusted-publishing.changed.md diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml index 0f85b21..e5258b2 100644 --- a/.github/workflows/push.yaml +++ b/.github/workflows/push.yaml @@ -76,6 +76,12 @@ jobs: FOLDER: docs/_build/html Publish: runs-on: ubuntu-latest + # PyPI trusted publishing: uploads accepted only from this workflow in the + # pypi environment (limited to master). No stored token. + environment: pypi + permissions: + contents: write # publish-git-tag.sh pushes the version tag + id-token: write if: | (github.repository == 'PolicyEngine/policyengine-il') && (github.event.head_commit.message == 'Update PolicyEngine Israel') @@ -95,8 +101,6 @@ jobs: - name: Publish a Python distribution to PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: - user: __token__ - password: ${{ secrets.PYPI }} skip_existing: true Deploy: if: | diff --git a/changelog.d/trusted-publishing.changed.md b/changelog.d/trusted-publishing.changed.md new file mode 100644 index 0000000..01577bf --- /dev/null +++ b/changelog.d/trusted-publishing.changed.md @@ -0,0 +1 @@ +Publish to PyPI with trusted publishing (OIDC) from the `pypi` environment instead of a stored API token. From 4b2303025218da8a71c4c0073af81f0391671b5c Mon Sep 17 00:00:00 2001 From: Anthony Volk <14987227+anth-volk@users.noreply.github.com> Date: Mon, 12 Oct 2026 18:53:21 +0400 Subject: [PATCH 2/2] Release above the stray 0.2.0 on PyPI PyPI already has policyengine-il 0.2.0 (uploaded 2026-02-24), above this repo's version line, so a patch release from the old version would sort below it and pip would keep installing 0.2.0. Start from 0.2.0 so this release is 0.2.1. Co-Authored-By: Claude Opus 5.5 --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index a9b8128..42ec42c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "policyengine-il" -version = "0.1.5" +version = "0.2.0" description = "Core microsimulation engine enabling country-specific policy models." readme = "README.md" authors = [