From a9081239473bfba6c125f9651013d63fe390ca06 Mon Sep 17 00:00:00 2001 From: Anthony Volk <14987227+anth-volk@users.noreply.github.com> Date: Mon, 12 Oct 2026 17:35:08 +0400 Subject: [PATCH 1/2] Publish to PyPI with trusted publishing Add environment: pypi and id-token: write to the job that runs pypa/gh-action-pypi-publish, and drop the user/password inputs that passed the org-wide secrets.PYPI token, so the upload uses OIDC. Add a changed fragment so merging cuts a patch release. Move the fragment under changelog.d/changed/ to changelog.d/.changed.md: bump_version.py only reads files at the top of changelog.d, so it exited with "No changelog fragments found" and has failed the Update versioning job on every push since #26. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/push.yaml | 8 ++++++-- ...te-to-app-token.md => migrate-to-app-token.changed.md} | 0 changelog.d/trusted-publishing.changed.md | 1 + 3 files changed, 7 insertions(+), 2 deletions(-) rename changelog.d/{changed/migrate-to-app-token.md => migrate-to-app-token.changed.md} (100%) create mode 100644 changelog.d/trusted-publishing.changed.md diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml index f02018d..a5eca9d 100644 --- a/.github/workflows/push.yaml +++ b/.github/workflows/push.yaml @@ -67,6 +67,12 @@ jobs: - uses: codecov/codecov-action@v6 Publish: runs-on: ubuntu-latest + # PyPI trusted publishing: uploads accepted only from this workflow in the + # pypi environment (limited to master). No stored token. + environment: pypi + permissions: + contents: write # publish-git-tag.sh pushes the version tag + id-token: write if: | (github.repository == 'PolicyEngine/policyengine-ng') && (github.event.head_commit.message == 'Update PolicyEngine Nigeria') @@ -86,8 +92,6 @@ jobs: - name: Publish a Python distribution to PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: - user: __token__ - password: ${{ secrets.PYPI }} skip_existing: true Deploy: if: | diff --git a/changelog.d/changed/migrate-to-app-token.md b/changelog.d/migrate-to-app-token.changed.md similarity index 100% rename from changelog.d/changed/migrate-to-app-token.md rename to changelog.d/migrate-to-app-token.changed.md diff --git a/changelog.d/trusted-publishing.changed.md b/changelog.d/trusted-publishing.changed.md new file mode 100644 index 0000000..01577bf --- /dev/null +++ b/changelog.d/trusted-publishing.changed.md @@ -0,0 +1 @@ +Publish to PyPI with trusted publishing (OIDC) from the `pypi` environment instead of a stored API token. From 12d638e6e1431ecab754a951eab3ffe681e57ca1 Mon Sep 17 00:00:00 2001 From: Anthony Volk <14987227+anth-volk@users.noreply.github.com> Date: Mon, 12 Oct 2026 18:53:25 +0400 Subject: [PATCH 2/2] Release above the stray 0.6.0 on PyPI PyPI already has policyengine-ng 0.6.0 (uploaded 2026-02-24), above this repo's version line, so a patch release from the old version would sort below it and pip would keep installing 0.6.0. Start from 0.6.0 so this release is 0.6.1. Co-Authored-By: Claude Opus 5.5 --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index b3d6a86..011c2a1 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "policyengine-ng" -version = "0.5.4" +version = "0.6.0" description = "Core microsimulation engine enabling country-specific policy models." readme = "README.md" authors = [