From 4c63c0c6f915f029b71c81e427178f7b6fbf50be Mon Sep 17 00:00:00 2001 From: Srikanth Bollampally Date: Fri, 17 Jul 2026 20:04:19 -0400 Subject: [PATCH] fix: use PyPI Trusted Publishing instead of a repo-secret API token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit publish-pypi tried password auth via secrets.PYPI_API_TOKEN, which was never actually set as a repo secret (v1.1.0 was published manually instead). With password empty, gh-action-pypi-publish fell back to OIDC trusted publishing, which then failed too since the job had no id-token permission. Switch to Trusted Publishing properly: add `permissions: id-token: write` and drop the password input so the action always uses OIDC. No long-lived token to rotate or leak. Requires a one-time trusted publisher registration on pypi.org (project kshield → Publishing → add YTT-Global/kshield, workflow release.yml) before the next tagged release. --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 61006c4..813312d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -176,6 +176,8 @@ jobs: needs: [publish] if: "!contains(github.ref_name, '-')" runs-on: ubuntu-22.04 + permissions: + id-token: write steps: - uses: actions/checkout@v4 @@ -192,5 +194,3 @@ jobs: - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@release/v1 - with: - password: ${{ secrets.PYPI_API_TOKEN }}