Publish to PyPI from GitHub releases via Trusted Publishing - #6
Merged
Conversation
Publishing a GitHub release builds the sdist/wheel and uploads to PyPI with OIDC (no stored credentials), after checking the release tag matches setup.py's version. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds an automated GitHub Actions publishing workflow so that creating a GitHub Release builds sdist/wheel and uploads to PyPI using PyPI Trusted Publishing (OIDC), with a guard that the release tag matches setup.py’s version.
Changes:
- Introduces a
Publishworkflow triggered onrelease.published. - Verifies the release tag equals the version in
setup.pybefore building. - Builds distributions and publishes to PyPI via
pypa/gh-action-pypi-publishusing OIDC.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Copilot flagged that the job-level permissions block left the checkout without contents: read (harmless on a public repo today, but implicit). Restructure into the shape the PyPA publish action recommends: a build job with contents: read producing the dist artifact, and a publish job holding only id-token: write, so no repository-controlled code runs while the Trusted Publishing OIDC token is available. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.
Comments suppressed due to low confidence (1)
.github/workflows/publish.yml:43
- The publish job restricts token permissions to only
id-token: write.actions/download-artifact@v4uses the GitHub Actions API to fetch the artifact and typically requiresactions: read; with the current permissions it may fail to download thedistartifact.
needs: build
environment: release
permissions:
id-token: write
steps:
- uses: actions/download-artifact@v4
with:
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publishing a GitHub release now builds the sdist/wheel and uploads it to PyPI via Trusted Publishing (OIDC — no token or password stored anywhere), after a guard checks the release tag matches
setup.py's version (tags here are plain0.0.6-style, matching the existing ones).One-time setup only you can do: in the PyPI project settings for
hamcrest-proto→ Publishing, add a GitHub trusted publisher with ownermdepinet, repositoryhamcrest-proto, workflowpublish.yml, environmentrelease. Until that's registered, the upload step will fail with an OIDC error.The first real run will be the
0.0.7release (main already carries the version bump from #5): create a GitHub release with tag0.0.7and this workflow does the rest. That run is also the workflow's first live test — the sed version-guard and build steps I verified locally, but the upload leg can only be proven by an actual release.Replaces the uncommitted
PUBLISHING.mdtwine flow as the durable directions.🤖 Generated with Claude Code