-
Notifications
You must be signed in to change notification settings - Fork 116
Change PyPI publishing to Trusted publishing
#275
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Codecov ReportPatch and project coverage have no change.
❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more. Additional details and impacted files@@ Coverage Diff @@
## develop #275 +/- ##
========================================
Coverage 85.92% 85.92%
========================================
Files 23 23
Lines 6081 6081
========================================
Hits 5225 5225
Misses 856 856
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Oh interesting, codecov wants us to install their app. Not sure why this is needed for public projects though |
rpm-build:fedora-rawhide-x86_64 has failed. Is it expected? |
@atztogo We need to configure spglib's PyPI project to add GitHub Actions as a trusted publisher. The "trusted publishing" seems to be recommended by PyPI, and I think that it is more secure than using secret tokens. What do you think?
|
Oh that's just a bug in scikit-build-core 0.4.0. (Mostly only relevant in packaging so won't edit pyproject.toml) /packit build |
Ping @jochym. Let's do it. |
Please use PyPI name for the environment spglib/.github/workflows/release.yml Line 23 in f877d94
And similar for test.pypi if we still want to use it spglib/.github/workflows/release.yml Line 41 in f877d94
(Or we could combine those 2 environments if it allows us) |
@LecrisUT
@atztogo Can you grant me access to manage spglib's TestPyPI project or set the trusted publisher for TestPyPI? I can set up them in PyPI but cannot in TestPyPI. |
@atztogo Thank you. |
f930418
to
4cae0fc
Compare
This eliminates the usage of secrets which can otherwise be a security issue https://github.com/pypa/gh-action-pypi-publish#trusted-publishing Signed-off-by: Cristian Le <cristian.le@mpsd.mpg.de>
Ok, made the changes and simplified the workflow back to the previous one |
This eliminates the usage of secrets which can otherwise be a security vulnerability. This is the implementation that
scikit-build-core
uses and where I got inspired for thisReference: https://github.com/pypa/gh-action-pypi-publish#trusted-publishing
@lan496 If we go with this, later the token secrets should be deleted.