[workflow] Enable trusted publishing - #59
Merged
gokulkrishna98 merged 7 commits intoAug 19, 2026
Merged
Conversation
Add a tag-triggered release workflow that builds the wheel and sdist, smoke-tests the built wheel on every supported Python version, and uploads to PyPI with `uv publish --trusted-publishing always`. Only the publish job holds `id-token: write`, and it runs no project code — it just downloads the artifact the earlier jobs vetted. Authentication is a short-lived OIDC token minted by GitHub Actions for that one job, so no PyPI API token is stored in the repo or in an org secret, and no developer holds a credential that can upload a release. The publish job waits on the `pypi` GitHub environment, whose protection rules (required reviewers with prevent-self-review, wait timer, `v*.*.*` tag restriction) live in repo settings rather than in this file. The build job fails if the pushed tag disagrees with __version__, since PyPI uploads are immutable and cannot be replaced. RELEASE.md documents the release steps and the one-time PyPI and GitHub configuration. Mirrors the release workflow in apple/coreai-optimization.
- Skip the release run unless hosted on github.com: PyPI Trusted Publishing only accepts OIDC tokens minted there, so a tag push elsewhere would run build and smoke-test and then discard the result. smoke-test and publish inherit the skip through `needs: build`. - Rebuild a wheel from the sdist in the build job. The sdist is published but never installed, so nothing caught a MANIFEST.in omission that breaks a build from source. Uses a scratch out-dir so dist/ stays as built. - Correct the smoke-test comment, which claimed broader coverage than the wheel-only script provides.
gokulkrishna98
changed the title
gokulkrishna98
marked this pull request as ready for review
August 18, 2026 20:30
dengqiaoyu
reviewed
Aug 19, 2026
madrob
reviewed
Aug 19, 2026
|
Nit: There is a file named |
dengqiaoyu
reviewed
Aug 19, 2026
Contributor
Author
Thanks, will remove it once verified that trusted publishing works. |
dengqiaoyu
reviewed
Aug 19, 2026
dengqiaoyu
approved these changes
Aug 19, 2026
Swap `uv publish --trusted-publishing always` for the PyPA action, so the upload path tracks PyPI protocol changes (attestation format, upload API) directly. Attestations and metadata verification are on by default, and with no `password` input the OIDC token is the only way it can authenticate. `setup-uv` is no longer needed in the publish job, which now runs two steps: download the artifact, upload it. `build` and `smoke-test` still use uv.
The step-by-step PyPI form walkthrough duplicated PyPI's own docs, which the page already links. Keep only what those docs cannot state: that the publisher must be bound to the `pypi` environment as well as the workflow, and what the environment's protection rules are, since that is this project's release policy. Also drops the claim that the configuration is already in place; it is not created yet.
gokulkrishna98
force-pushed
the
dev/gokul/trusted_publishing
branch
from
August 19, 2026 16:59
0fec23a to
b86d832
Compare
The workflow builds, tests, and publishes from the tag, so the tag is the trust anchor for the whole release. Use `git tag -s` and confirm GitHub reports it as Verified.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
.github/workflows/release.yml, which publishes to PyPI on avX.Y.Ztag push using Trusted Publishing: https://docs.pypi.org/trusted-publishers/ - a short-lived OIDC token minted for one job