PyPI releases with OIDC/Trusted Publishing

[achamayou]

https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-pypi

[achamayou]

Does twine support trusted publishing?
Short answer: Yes, but indirectly. Twine itself does not perform the OIDC token exchange — it uploads with a username/password (or API token). The trusted-publishing flow works by having something else exchange the OIDC token for a short-lived PyPI API token, which can then be fed to twine.

Two pieces of evidence from the docs and source:

Twine has no --oidc or "trusted publishing" flag in its CLI options. The full twine upload option list (twine 6.2.0 docs(opens in new window)) covers --username, --password, --repository, --attestations, etc. — there is no built-in OIDC exchange flag.

Twine does, however, transparently handle the token returned by trusted publishing. The twine repo contains a feature explicitly called out in its commit history: "Automatically replace Trusted Publishing Tokens" (pypa/twine on GitHub(opens in new window)). This means when you feed twine a PyPI-issued trusted-publishing token (which is short-lived), it handles refresh/replacement automatically during the upload.

The officially recommended flow (PyPI Trusted Publishers docs(opens in new window)) is:

Use the
gh-action-pypi-publish
(opens in new window) GitHub Action — it performs the OIDC exchange with PyPI, retrieves the short-lived API token, and then invokes twine to upload.
For non-GitHub CI, use id(opens in new window) + a small script to do the OIDC exchange yourself, then call twine upload with the returned token as TWINE_PASSWORD and token as TWINE_USERNAME.
Key links:

Twine documentation: https://twine.readthedocs.io/en/stable/(opens in new window)
Twine source / repo: https://github.com/pypa/twine(opens in new window)
PyPI Trusted Publishers guide: https://docs.pypi.org/trusted-publishers/(opens in new window)
PyPA publishing GitHub Action (wraps twine): https://github.com/pypa/[gh-action-pypi-publish(opens in new window)](https://github.com/pypa/gh-action-pypi-publish)
Packaging User Guide — GitHub Actions CI/CD: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/(opens in new window)
So: twine is compatible with trusted publishing and aware of the token type, but the OIDC exchange itself lives outside twine — typically in the PyPA GitHub Action.