|
| 1 | +--- |
| 2 | +name: Publish to PyPI via Trusted Publishing |
| 3 | +description: > |
| 4 | + Download the build artifact (which carries its own PEP 740 attestation |
| 5 | + sidecars, generated at build time) and upload everything to PyPI using |
| 6 | + OIDC-based Trusted Publishing (no long-lived API token). |
| 7 | +
|
| 8 | +# This composite action is a workaround for pypi/warehouse#11096: PyPI's |
| 9 | +# Trusted Publisher config matches the OIDC `job_workflow_ref` claim against |
| 10 | +# the *caller's* workflow file, but reusable workflows mint a token whose |
| 11 | +# `job_workflow_ref` names the reusable workflow. Composite actions inherit |
| 12 | +# the calling job's OIDC context, so invoking this action from a downstream |
| 13 | +# caller's `release.yaml` keeps `job_workflow_ref` pointing at that file — |
| 14 | +# which is what the downstream's PyPI Trusted Publisher must register. |
| 15 | + |
| 16 | +inputs: |
| 17 | + artifact-name: |
| 18 | + description: Name of the dist artifact uploaded by the upstream build job. |
| 19 | + required: true |
| 20 | + repository-url: |
| 21 | + description: > |
| 22 | + Optional override for the PyPI repository URL (e.g., TestPyPI). Leave |
| 23 | + empty to publish to the canonical PyPI index. |
| 24 | + required: false |
| 25 | + default: "" |
| 26 | + |
| 27 | +runs: |
| 28 | + using: composite |
| 29 | + steps: |
| 30 | + - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0 |
| 31 | + with: |
| 32 | + enable-cache: false |
| 33 | + |
| 34 | + - name: Download build artifact |
| 35 | + id: download |
| 36 | + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 |
| 37 | + with: |
| 38 | + name: ${{ inputs.artifact-name }} |
| 39 | + path: dist/ |
| 40 | + |
| 41 | + - name: Push to PyPI |
| 42 | + env: |
| 43 | + DOWNLOAD_PATH: ${{ steps.download.outputs.download-path }} |
| 44 | + REPOSITORY_URL: ${{ inputs.repository-url }} |
| 45 | + shell: bash |
| 46 | + run: | |
| 47 | + args=(--no-progress publish --trusted-publishing automatic) |
| 48 | + if [[ -n "${REPOSITORY_URL}" ]]; then |
| 49 | + args+=(--publish-url "${REPOSITORY_URL}") |
| 50 | + fi |
| 51 | + uv "${args[@]}" "${DOWNLOAD_PATH}"/* |
0 commit comments