ci(release): PyPI Trusted Publishing#19
Conversation
Add a pypi-publish job using pypa/gh-action-pypi-publish with id-token: write (no stored token). github-release now guards on tag refs; a workflow_dispatch run publishes the current build to PyPI without recreating a GitHub release — used to publish an already-tagged version (v1.6.0). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f1c15d37e3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| permissions: | ||
| contents: write # create the GitHub release (the sole distribution channel) | ||
| workflow_dispatch: # manual (re)publish — e.g. push an already-tagged version to PyPI |
There was a problem hiding this comment.
When a maintainer manually dispatches this workflow from any branch other than main (GitHub's manual-run UI/CLI allow selecting a branch/ref, and github.ref then points at that ref), the build checks out that branch and pypi-publish still gets OIDC credentials and uploads it. That contradicts the "current main build" release path and can publish an unreviewed branch/version to PyPI without a GitHub release; add an if guard for workflow_dispatch on refs/heads/main or explicitly check out main for manual publishes.
Useful? React with 👍 / 👎.
1 participant
Wires PyPI publishing into
release.ymlvia Trusted Publishing (OIDC) — no stored token.pypi-publishjob (pypa/gh-action-pypi-publish,id-token: write,environment: pypi) consumes the samedist/artifact that already passedtwine check+ clean-machine smoke.github-releasenow guards onrefs/tags/*, and aworkflow_dispatchtrigger lets us publish the currentmainbuild to PyPI without recreating a GitHub release — used to push the already-tagged v1.6.0 to PyPI.v*tags publish to both GitHub and PyPI automatically.RELEASE_CHECKLIST.mdintro updated (no longer "GitHub-only").🤖 Generated with Claude Code