Change PyPI publishing to Trusted publishing#275
Conversation
Codecov ReportPatch and project coverage have no change.
❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more. Additional details and impacted files@@ Coverage Diff @@
## develop #275 +/- ##
========================================
Coverage 85.92% 85.92%
========================================
Files 23 23
Lines 6081 6081
========================================
Hits 5225 5225
Misses 856 856
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
|
Oh interesting, codecov wants us to install their app. Not sure why this is needed for public projects though |
|
rpm-build:fedora-rawhide-x86_64 has failed. Is it expected? |
|
@atztogo We need to configure spglib's PyPI project to add GitHub Actions as a trusted publisher. The "trusted publishing" seems to be recommended by PyPI, and I think that it is more secure than using secret tokens. What do you think?
|
Oh that's just a bug in scikit-build-core 0.4.0. (Mostly only relevant in packaging so won't edit pyproject.toml) /packit build |
Ping @jochym. Let's do it. |
|
I have added GitHub as trusted publiser for spglib's PyPI project. |
Please use PyPI name for the environment spglib/.github/workflows/release.yml Line 23 in f877d94 And similar for test.pypi if we still want to use it spglib/.github/workflows/release.yml Line 41 in f877d94 (Or we could combine those 2 environments if it allows us) |
|
@LecrisUT
@atztogo Can you grant me access to manage spglib's TestPyPI project or set the trusted publisher for TestPyPI? I can set up them in PyPI but cannot in TestPyPI. |
|
@atztogo Thank you. |
LecrisUT
force-pushed
the
ci/PyPI
branch
2 times, most recently
from
f930418 to
4cae0fc
Compare
This eliminates the usage of secrets which can otherwise be a security issue https://github.com/pypa/gh-action-pypi-publish#trusted-publishing Signed-off-by: Cristian Le <[email protected]>
|
Ok, made the changes and simplified the workflow back to the previous one |
4 participants
This eliminates the usage of secrets which can otherwise be a security vulnerability. This is the implementation that
scikit-build-coreuses and where I got inspired for thisReference: https://github.com/pypa/gh-action-pypi-publish#trusted-publishing
@lan496 If we go with this, later the token secrets should be deleted.