Skip to content

feat(ci): switch to uv publish for PyPI uploads #13991

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alex merged 6 commits into from
Apr 25, 2026
+19 −9
Merged

feat(ci): switch to uv publish for PyPI uploads #13991

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
83b35b9
feat(ci): switch to uv publish for PyPI uploads
woodruffw Dec 10, 2025
d09e541
Bump attest-action
woodruffw Feb 10, 2026
69ced90
Ensure uv is installed
woodruffw Feb 10, 2026
4797218
Switch to setup-python and bootstrap uv via pip
woodruffw Apr 24, 2026
0641eae
Re-bump action
woodruffw Apr 25, 2026
36d51b2
Disable setup-python cache
woodruffw Apr 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 19 additions & 9 deletions .github/workflows/pypi-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,14 @@ jobs:
echo "PYPI_URL=https://test.pypi.org/legacy/" >> $GITHUB_ENV
if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'testpypi'

- name: Setup python
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
with:
python-version: '3.14'
timeout-minutes: 3

- run: python -m pip install -c ci-constraints-requirements.txt 'uv'

- uses: dawidd6/action-download-artifact@8305c0f1062bb0d184d09ef4493ecb9288447732 # v20
with:
path: tmpdist/
Expand All @@ -51,13 +59,15 @@ jobs:
- run: |
find tmpdist/ -type f -name 'cryptography*' -exec mv {} dist/ \;

- uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6
# Do not perform attestation for things for TestPyPI. This is
# because there's nothing that would prevent a malicious PyPI from
# serving a signed TestPyPI asset in place of a release intended for
# PyPI.
if: env.PYPI_URL == 'https://upload.pypi.org/legacy/'

- name: Publish package distributions to PyPI
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
with:
repository-url: ${{ env.PYPI_URL }}
skip-existing: true
# Do not perform attestation for things for TestPyPI. This is
# because there's nothing that would prevent a malicious PyPI from
# serving a signed TestPyPI asset in place of a release intended for
# PyPI.
attestations: ${{ env.PYPI_URL == 'https://upload.pypi.org/legacy/' }}
run: |
uv publish --trusted-publishing=always dist/*
Comment thread
woodruffw marked this conversation as resolved.
env:
UV_PUBLISH_URL: ${{ env.PYPI_URL }}