Skip to content

Commit

Permalink
Convert publishing workflows to trusted publishers
Browse files Browse the repository at this point in the history
  • Loading branch information
@sirosen
sirosen committed Aug 25, 2023
1 parent e22f8a2 commit a9a3504
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 3 deletions.
5 changes: 3 additions & 2 deletions .github/workflows/publish_to_pypi.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,9 @@ on:
jobs:
publish:
runs-on: ubuntu-latest
environment: publish
permissions:
id-token: write

This comment has been minimized.

Sign in to view

Copy link
@webknjaz

webknjaz Aug 25, 2023

@sirosen may I suggest that you spit this into two jobs? Security-wise, it's a bad idea to expose the OIDC token to the build process, as it can be poisoned on many levels.

We're still working on a PyPUG guide update with more concrete examples, but the basic idea is that you upload a GHA artifact in the build job and retrieve it in the first step of the publish job.

This comment has been minimized.

Sign in to view

Copy link
@sirosen

sirosen Aug 25, 2023

Author Member

Ah, thank you for calling this out; I wasn't aware of a security concern with this pattern.

Do you have any projects I could look at for prior art? I think I get the idea -- job1 does build+upload and job2 does download+publish -- but it's always easier to follow where someone else has gone before. 🙂

This comment has been minimized.

Sign in to view

Copy link
@sirosen

sirosen Aug 25, 2023

Author Member

Thanks so much! These resources are fantastic.

I'll get my workflows adapted today. I'm happy to leave feedback via some other channel, but I'll just mention briefly: it might be worth adding a complete example workflow which does the build+publish steps. For less experienced users, being able to copy-paste a full workflow file and have it work will probably save them from common mistakes (putting jobs in separate workflows, getting indentation wrong, etc).

This comment has been minimized.

Sign in to view

Copy link
@webknjaz

webknjaz Aug 25, 2023

Thanks! I'll link your comment from the PR. It's probably a good idea to include the entire workflow at the end (probably collapsed).

steps:
- uses: actions/checkout@v3
Expand All @@ -19,5 +22,3 @@ jobs:

- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
password: ${{ secrets.PYPI_API_TOKEN }}
4 changes: 3 additions & 1 deletion .github/workflows/publish_to_test_pypi.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,9 @@ on:
jobs:
publish:
runs-on: ubuntu-latest
environment: publish-testpypi
permissions:
id-token: write

steps:
- uses: actions/checkout@v3
Expand All @@ -36,5 +39,4 @@ jobs:
- name: Publish to TestPyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
password: ${{ secrets.TEST_PYPI_API_TOKEN }}
repository_url: https://test.pypi.org/legacy/

0 comments on commit a9a3504

Please sign in to comment.