Merge pull request #206 from COMP1010UNSW/maddy-oidc-publish

Configure OIDC publishing to pypi

Author: MaddyGuthridge

.github/workflows/publish.yml

@@ -1,21 +1,24 @@
 # Publish a Python package to PyPi using uv
 name: Publish Package on PyPi
 
-permissions:
-  contents: read
 on:
   release:
     types: [published]
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v6
       - name: Install uv
         uses: astral-sh/setup-uv@v7
         with:
-          enable-cache: true
+          # Intentionally disabled to prevent poisoning
+          enable-cache: false
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
@@ -24,4 +27,4 @@ jobs:
       - name: Build package
         run: uv build
       - name: Publish package
-        run: uv publish -t ${{ secrets.PYPI_API_TOKEN }}
+        run: uv publish

.github/workflows/regenerate-tags.yml

@@ -14,6 +14,7 @@ on:
 jobs:
   Regenerate-Tags:
     runs-on: ubuntu-latest
+    environment: docs-scraper
     steps:
       - uses: actions/checkout@v6
       - name: Set up Python

pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "pyhtml-enhanced"
 version = "2.3.2"
-description = "A library for building HTML documents with a simple and learnable syntax"
+description = "Build HTML documents in Python with a simple and learnable syntax"
 authors = [{ name = "Maddy Guthridge", email = "maddy.guthridge@unsw.edu.au" }]
 license = {text = "MIT"}
 readme = "README.md"
@@ -11,7 +11,6 @@ classifiers = [
     "Programming Language :: Python :: 3",
     "Intended Audience :: Developers",
     "Intended Audience :: Education",
-    "License :: OSI Approved :: MIT License",
     "Operating System :: OS Independent",
     "Development Status :: 5 - Production/Stable",
     "Topic :: Internet :: WWW/HTTP :: Dynamic Content",
@@ -51,21 +50,14 @@ docs = [
     "mkdocs-awesome-pages-plugin>=2.9.3",
     "mkdocs-section-index>=0.3.10",
     # Explicitly include pygments to override its version using uv sources
-    "pygments>=2.19.2",
+    "pygments>=2.20.0",
 ]
 
 [tool.uv]
 # Exclude dependency releases newer than 1 week, in order to reduce supply-chain
 # risk.
 exclude-newer = "1 week"
 
-[tool.uv.sources]
-# Until pygments does another release, we should take it from git. Otherwise,
-# our documentation's t-strings will be formatted incorrectly.
-# Pinning to a specific revision to ensure that we don't accidentally get
-# malware if someone does a malicious commit or something.
-pygments = { git = "https://github.com/pygments/pygments", rev = "28ec10c5e154ee27201997feb573a0b065f74082" }
-
 [build-system]
 requires = ["uv_build>=0.7.20,<0.12.0"]
 build-backend = "uv_build"