feat: add PyPI trusted publishing - #37
Conversation
Sorry, something went wrong.
There was a problem hiding this comment.
Pull request overview
This PR updates the project’s GitHub Actions workflows to publish releases to PyPI via Trusted Publishing (OIDC) instead of a long-lived PyPI API token, and expands CI/release testing to include Python 3.14.
Changes:
- Switch PyPI publishing in the release workflow from twine + PYPI_API_TOKEN to pypa/gh-action-pypi-publish with OIDC and a protected pypi environment.
- Add Python 3.14 to CI and release matrices, and run example tests on 3.14.
- Update README publishing docs to remove the PYPI_API_TOKEN secret requirement.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| README.md | Removes PYPI_API_TOKEN from documented required secrets, aligning docs with OIDC trusted publishing. |
| .github/workflows/release.yml | Adds Python 3.14 to the release test matrix and switches publishing to OIDC trusted publishing (with pypi environment + id-token). |
| .github/workflows/ci.yml | Adds Python 3.14 to CI matrix and moves example tests to run on 3.14. |
.github/workflows/release.yml:23
- actions/checkout@v6 and actions/setup-python@v6 are not valid major versions. Use the current supported major versions so the workflow doesn’t fail at runtime (checkout v7, setup-python v5).
- uses: actions/checkout@v6
- uses: actions/setup-python@v6
with:
python-version: ${{ matrix.python-version }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sorry, something went wrong.
ilyazub
left a comment
There was a problem hiding this comment.
Thanks @adarshdigievo !
Sorry, something went wrong.
| TWINE_USERNAME: __token__ | ||
| TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }} | ||
| run: twine upload dist/* | ||
| uses: pypa/gh-action-pypi-publish@release/v1 |
There was a problem hiding this comment.
Thanks for switching to official solution.
Sorry, something went wrong.
This PR modernizes the release process by replacing long-lived PyPI API tokens with PyPI Trusted Publishing.
Changes made: