pypiupload.yml

# This workflow will upload a Python Package using Twine when a release is created
# For more information see: https://help.github.com/en/actions/language-and-framework-guides/using-python-with-github-actions#publishing-to-package-registries

name: Publish to PyPi

on:
  release:
    types: [created]
  workflow_dispatch:  # Allow manual trigger for testing

permissions:  # least privilege; the deploy job overrides this for OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:  # required for OIDC authentication
      id-token: write
      contents: read

    steps:
    - uses: actions/checkout@v7

    - name: Configure AWS credentials (OIDC)
      uses: aws-actions/configure-aws-credentials@v6
      with:
        role-to-assume: arn:aws:iam::082972943155:role/oidc-github-dropbox-dropbox-sdk-python-repo
        aws-region: us-west-2
    - name: Get PyPI token from AWS Secrets Manager
      id: get-secret
      uses: aws-actions/aws-secretsmanager-get-secrets@v3
      with:
        # Referenced by friendly name; Secrets Manager appends a random suffix to
        # the full ARN, so the name is the stable identifier.
        secret-ids: |
          PYPI_SECRET,pypi-api-token-dropbox-sdk-python
        parse-json-secrets: false
    - name: Setup Python environment
      uses: actions/setup-python@v6
      with:
        python-version: "3.x"
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        python -m pip install build twine
    - name: Build sdist and wheel
      run: python -m build
    - name: Publish
      env:
        TWINE_USERNAME: __token__
        TWINE_PASSWORD: ${{ env.PYPI_SECRET }}
      run: |
        twine check dist/*
        twine upload dist/*