A GitHub Action that generates PEP 740 publish attestations for your Python packages.

To use this action, you should be using Trusted Publishing to publish your packages (to pyx, PyPI, or another compatible index).

• Usage
  • Prerequisites
  • Quickstart
• Inputs
  • paths
  • overwrite
• Outputs

To use this action, you must have a Trusted Publisher configured for your project on your target index (or indices). Refer to your index's documentation for more information on Trusted Publishing:

• pyx - Trusted Publishing
• PyPI - Trusted Publishing

As with Trusted Publishing itself, this action requires the id-token: write permission on your publishing job. For example:

permissions:
  id-token: write # for Trusted Publishing + attest-action
  contents: read # for actions/checkout, if you're in a private repo

In order to upload the resulting attestations to an index, you must use a publishing tool that supports PEP 740 attestations. Such tools include:

• uv (uv publish) versions 0.9.12 and later
• twine (twine upload) versions 5.1.0 and later

Add astral-sh/attest-action directly above your publishing step in your publishing job.

For example:

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read

    needs: [build]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: dist

      - uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6

      - run: uv publish

If you have a custom path (or paths) to your distributions, you can specify them via the paths input as whitespace-separated values.

- uses: astral-sh/attest-action@f589a42a7efb6fe400b4f400de60b4bc90390027 # v0.0.6
  with:
  paths: |
    custom-dist-dir/*
    wheelhouse/*

Default: dist/*

One or more whitespace-separated directories or glob patterns to search for Python distributions to generate attestations for.

Recursive globs may be used, e.g. dist/** to find all distributions within dist/ and its subdirectories.

Default: false

If false (the default), any existing publish attestations that would have been overwritten will instead cause the action to fail.

If true, existing attestations will be overwritten.

This action currently has no outputs.

attest-action is licensed under either of

• Apache License, Version 2.0, (LICENSE-APACHE or https://www.apache.org/licenses/LICENSE-2.0)
• MIT license (LICENSE-MIT or https://opensource.org/licenses/MIT)

at your option.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in attest-action by you, as defined in the Apache-2.0 license, shall be dually licensed as above, without any additional terms or conditions.