From e4575248ceeeaf0993346db807ae44199b902459 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 21 Jun 2026 05:54:05 +0000 Subject: [PATCH] Use PyPI Trusted Publishing (OIDC) for the publish workflow Drop the token password input so the publish step authenticates purely via OIDC Trusted Publishing; keep workflow_dispatch for on-demand publishing. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_013KvuS9HKbnZAwwFJyBkyHc --- .github/workflows/python-publish.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index 5059cf6..1d9246d 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -61,11 +61,11 @@ jobs: name: release-dists path: dist/ + # Authentication is via PyPI Trusted Publishing (OIDC) — no token needed. + # Configure the trusted publisher once on PyPI (see below) with: + # owner: krichelj repo: PyDiffGame + # workflow: python-publish.yml environment: pypi - name: Publish release distributions to PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: packages-dir: dist/ - # Authenticate with a PyPI API token stored as the repository secret - # PYPI_API_TOKEN. (Leave this secret unset to fall back to OIDC - # Trusted Publishing instead.) - password: ${{ secrets.PYPI_API_TOKEN }}