Use PyPI's "Trusted Publisher" integration in publish.yaml

iiasa / actions

GitHub Actions used by IIASA repositories

GNU General Public License v3.0

0 stars 1 forks source link

Use PyPI's "Trusted Publisher" integration in publish.yaml #10

Open khaeru opened 1 year ago

khaeru commented 1 year ago

DO NOT MERGE.

This PR updates the publish.yaml workflow that is reused in several of our other repos, to use PyPI's new OpenID Connect integration with GitHub. See https://docs.pypi.org/trusted-publishers/

This PR should not be merged until using workflows have all been migrated; in the meantime it's only here to make the branch salient.

The using workflows include, at least:

[ ] iiasa/ixmp
[ ] iiasa/message_ix
[ ] iiasa/message-ix-models
[ ] khaeru/genno
[ ] khaeru/sdmx#127

khaeru commented 1 year ago

Note that per pypi/warehouse#11096 (though not the official docs at https://docs.pypi.org/trusted-publishers/) and some experimentation it appears using this is not yet supported via reusable workflows. Queued until it is.