Use PyPI Trusted Publishing (OIDC) in publish.yml instead of an API token#31
Conversation
Replace the API-token-based poetry publish with the official pypa/gh-action-pypi-publish action, which authenticates via OIDC now that GitHub Actions is configured as a Trusted Publisher on PyPI. The job's permissions are now declared explicitly to grant id-token: write, restoring contents/issues/pull-requests access the release steps relied on implicitly.
bradymholt
changed the title
publish.yml instead of an API token
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
bradymholt
requested review from
a team and
dbertram
and removed request for
a team
dbertram
left a comment
dbertram
left a comment
There was a problem hiding this comment.
One possible comment correction + a curiosity.
Approving in case I'm misunderstanding which permissions are needed for which functionality.
| issues: write # comment on PRs included in the release | ||
| pull-requests: write |
There was a problem hiding this comment.
| issues: write # comment on PRs included in the release | |
| pull-requests: write | |
| issues: write | |
| pull-requests: write # comment on PRs included in the release |
?
Also, just curious, but what is the issues: write needed for?
There was a problem hiding this comment.
Good question - I confirmed and issues: write isn't needed at all. Commenting on a PR via the issues.createComment API keys its permission off the target resource, so pull-requests: write covers it. We never comment on a real issue here, so I dropped issues: write entirely and moved your comment onto pull-requests: write in 9fd31c1. Thanks!
There was a problem hiding this comment.
Follow-up nit: can/should we drop the issues: write permission from that ynab-sdk-ruby GH workflow as well then?
Commenting on PRs via the issues API keys its permission off the target resource, so pull-requests: write covers it. The workflow never comments on a real issue, so issues: write was unnecessary.
2 participants
I've configured GitHub Actions as a Trusted Publisher for this project on PyPI, so the publish workflow no longer needs a long-lived API token. This swaps the token-based
poetry publishstep for the officialpypa/gh-action-pypi-publishaction, which authenticates via OIDC. Poetry itself doesn't speak OIDC, but it still handles the build; the action just publishes whateverpoetry buildput indist/, which is its default package directory.The job now declares an explicit
permissionsblock to grantid-token: write(required for OIDC). Since declaring permissions drops everything else tonone, the block also restorescontents: write(creating the GitHub Release) andissues/pull-requests: write(the step that comments on PRs included in the release). The commit-and-push step is unaffected because it uses theGH_API_TOKENPAT. The new action is pinned by commit SHA to match the rest of the workflow.The Trusted Publisher on PyPI is configured against this repo and the
publish.ymlfilename, with no environment restriction.A similar change was made for the Ruby SDK here.
Follow-ups after the first successful publish
POETRY_PYPI_TOKEN_PYPIrepo secret