From c1824588199ac178715105293933c645dfb576e8 Mon Sep 17 00:00:00 2001 From: Ryan Hill Date: Mon, 24 Aug 2026 17:22:46 -0500 Subject: [PATCH 1/2] ci: publish publish.yml via trusted publishing instead of an API token --- .github/workflows/publish.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 12df9db..48ac025 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -21,6 +21,9 @@ jobs: pypi-publish: name: Build dist & upload to PyPI runs-on: ubuntu-latest + permissions: + id-token: write # mint the OIDC token PyPI trusted publishing verifies + contents: read # actions/checkout if: ${{ github.actor == 'github-actions[bot]' || github.actor == 'ryanhill1' }} environment: release steps: @@ -40,6 +43,3 @@ jobs: - name: Publish package to PyPI uses: pypa/gh-action-pypi-publish@release/v1 - with: - user: __token__ - password: ${{ secrets.PYPI_API_TOKEN }} From 889bba8c19a7716c281124eb2afa2910e750e3b2 Mon Sep 17 00:00:00 2001 From: Ryan Hill Date: Mon, 24 Aug 2026 17:22:47 -0500 Subject: [PATCH 2/2] ci: publish pre-release.yml via trusted publishing instead of an API token --- .github/workflows/pre-release.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pre-release.yml b/.github/workflows/pre-release.yml index 4922742..80b9198 100644 --- a/.github/workflows/pre-release.yml +++ b/.github/workflows/pre-release.yml @@ -21,6 +21,9 @@ jobs: pypi-publish: name: Build dist & upload to PyPI runs-on: ubuntu-latest + permissions: + id-token: write # mint the OIDC token PyPI trusted publishing verifies + contents: read # actions/checkout if: ${{ github.actor == 'github-actions[bot]' || github.actor == 'ryanhill1' }} steps: - uses: actions/checkout@v4 @@ -54,6 +57,4 @@ jobs: - name: Publish package to PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: - user: __token__ - password: ${{ secrets.PYPI_API_TOKEN }} packages-dir: ${{ steps.build-dev.outputs.dir }} \ No newline at end of file