Skip to content

Split PyPI publishing workflow: isolate OIDC-privileged upload into its own job #230

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 4 commits into from
Closed

Split PyPI publishing workflow: isolate OIDC-privileged upload into its own job #230

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1b2ed4b
Initial plan
Copilot Apr 23, 2026
90101af
Add PyPI publishing workflow with separate build and publish jobs
Copilot Apr 23, 2026
36500e0
Merge branch 'main' into copilot/split-pypi-publishing-workflow
kevinbackhouse May 12, 2026
37d8edf
Rename publish-to-pypi.yml to publish-to-pypi.yaml
Copilot May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions .github/workflows/publish-to-pypi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
name: Publish to PyPI

on:
release:
types: [published]

jobs:
build:
name: Build distribution
runs-on: ubuntu-latest
permissions:
contents: read

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.11'

- name: Install Hatch
run: pip install --upgrade hatch

- name: Build distribution packages
run: hatch build
Copy link
Copy Markdown

@webknjaz webknjaz Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No need for a custom frontend really. Just use a PyPA project.

Suggested change
- name: Install Hatch
run: pip install --upgrade hatch
- name: Build distribution packages
run: hatch build
- name: Install the build frontend
run: python -Im pip install --upgrade build
- name: Build distribution packages
run: python -Im build

Although, I must say, it may be a good idea to make this somewhat more predicatable by having a build-deps.in and build-deps.txt managed by pip-tools (supported by Dependabot natively). With just build in build-deps.in.

It's usable as follows:

Suggested change
- name: Install Hatch
run: pip install --upgrade hatch
- name: Build distribution packages
run: hatch build
- name: Install the build frontend
run: python -Im pip install -r build-deps.in -c build-deps.txt
- name: Build distribution packages
run: python -Im build

I often take this a bit farther by also pinning the isolated build env:

pip-compile --all-build-deps --only-build-deps --output-file=build-lock.txt --strip-extras pyproject.toml

(https://pip-tools.rtfd.io/en/latest/#maximizing-reproducibility)

This would integrate as follows:

Suggested change
- name: Install Hatch
run: pip install --upgrade hatch
- name: Build distribution packages
run: hatch build
- name: Install the build frontend
run: python -Im pip install --requirement=build-deps.in --constraint=build-deps.txt
- name: Build distribution packages
env:
PIP_CONSTRAINT: build-lock.txt
run: python -Im build


- name: Upload distribution artifacts
uses: actions/upload-artifact@v4
with:
name: python-package-distributions
path: dist/

publish-to-pypi:
name: Publish to PyPI
Copy link
Copy Markdown

@webknjaz webknjaz Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you'll want the same for testpypi I imagine?

needs: build
runs-on: ubuntu-latest
environment:
name: pypi
Copy link
Copy Markdown

@webknjaz webknjaz Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check the repo settings and make sure this is behind an approval button so that when the dists are built, there's that last line of defense where a human can double-check the artifacts if needed.

url: https://pypi.org/p/seclab-taskflow-agent
permissions:
id-token: write # Required for OIDC trusted publishing

steps:
- name: Download distribution artifacts
uses: actions/download-artifact@v4
with:
name: python-package-distributions
path: dist/

- name: Publish to PyPI
uses: pypa/gh-action-pypi-publish@release/v1

Check warning

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow Medium

Unpinned 3rd party Action 'Publish to PyPI' step
Uses Step
Loading
uses 'pypa/gh-action-pypi-publish' with ref 'release/v1', not a pinned commit hash
Loading