feat: use PyPI OIDC for release (#1957)

Signed-off-by: Keming <[email protected]>
tensorchord · Jan 20, 2025 · f6d9fd2 · f6d9fd2
1 parent 600e0df
commit f6d9fd2
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 8 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -45,6 +45,8 @@ jobs:
     if: github.repository == 'tensorchord/envd' && startsWith(github.ref, 'refs/tags/v')
     runs-on: ${{ matrix.os }}
     timeout-minutes: 20
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
     strategy:
       matrix:
         os: [macos-13, ubuntu-22.04]
@@ -83,14 +85,12 @@ jobs:
         python -m pip install wheel
         python setup.py sdist
         mv dist/*.tar.gz wheelhouse/
-    - name: Upload to PyPI
-      env:
-        TWINE_USERNAME: __token__
-        TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install twine
-        python -m twine upload wheelhouse/*
+    - name: Publish package distributions to PyPI
+      uses: pypa/gh-action-pypi-publish@release/v1
+      with:
+        packages-dir: wheelhouse/
+        skip-existing: true
+        verbose: true
   image_publish:
     name: Build & push images
     # only trigger on main repo when tag starts with v

diff --git a/...images/julia1.8rc1-ubuntu20.04.Dockerfile → ...images/julia1.8rc1-ubuntu22.04.Dockerfile b/...images/julia1.8rc1-ubuntu20.04.Dockerfile → ...images/julia1.8rc1-ubuntu22.04.Dockerfile