Skip to content

Commit 4722e6a

Browse files
authored
build: switch to trusted publishing (#3059)
* switch to trusted publishing * mention trusted publisher management in release instructions Clarified instructions for community contributors regarding version releases.
1 parent a0e4b84 commit 4722e6a

2 files changed

Lines changed: 6 additions & 6 deletions

File tree

.github/workflows/CI_pypi_release.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ on:
2121
jobs:
2222
release-on-pypi:
2323
runs-on: ubuntu-slim
24+
permissions:
25+
id-token: write
2426

2527
steps:
2628
- name: Checkout
@@ -54,11 +56,9 @@ jobs:
5456
run: hatch build
5557

5658
- name: Publish on PyPi
57-
working-directory: ${{ steps.pathfinder.outputs.project_path }}
58-
env:
59-
HATCH_INDEX_USER: __token__
60-
HATCH_INDEX_AUTH: ${{ secrets.PYPI_API_TOKEN }}
61-
run: hatch publish -y
59+
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
60+
with:
61+
packages-dir: ${{ steps.pathfinder.outputs.project_path }}/dist
6262

6363
- name: Generate changelog
6464
uses: orhun/git-cliff-action@c93ef52f3d0ddcdcc9bd5447d98d458a11cd4f72 # v4.7.1

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ Please check out our [Contribution Guidelines](CONTRIBUTING.md) for all the deta
8585
> [!NOTE]
8686
> Only maintainers can release new versions of integrations.
8787
> If you're a community contributor and want to release a new version of an integration,
88-
> reach out to a maintainer.
88+
> reach out to a maintainer. They will set up trusted publisher management for PyPI.
8989
9090
To release a new version of an integration to PyPI tag the commit with the right version number and push the tag to
9191
GitHub. The GitHub Actions workflow will take care of the rest.

0 commit comments

Comments
 (0)