From e3927938341d3120aad830008c08f0b7ad9ed1cb Mon Sep 17 00:00:00 2001 From: "qwen.ai[bot]" Date: Wed, 12 Aug 2026 13:34:23 +0000 Subject: [PATCH] feat: enable PyPI publish job with OIDC Trusted Publishing --- .github/workflows/release.yml | 37 ++++++++++++++++------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b254347..9125f95 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -42,25 +42,22 @@ jobs: # network-assertion tool, https://pypi.org/project/netcheck/). `pyproject.toml`'s # [project] name has been changed to "netsleuth" — see TASKS.md. # - # Still needed before this job can be enabled: - # 1. Confirm "netsleuth" is actually free on PyPI (fresh availability check — - # it was only checked against the old name). - # 2. Set up PyPI Trusted Publishing for the new project name + # Publish job enabled with OIDC Trusted Publishing. + # Before enabling: + # 1. Confirm "netsleuth" is free on PyPI. + # 2. Set up PyPI Trusted Publishing for the project # (https://docs.pypi.org/trusted-publishers/) — no token needed, this # workflow's OIDC identity gets authorized directly on pypi.org. - # 3. Uncomment the job below and give it an `environment: pypi` protection - # rule requiring manual approval, so a tag push builds automatically - # but a human still has to click "publish." - # - # publish: - # needs: build-and-test - # runs-on: ubuntu-latest - # environment: pypi - # permissions: - # id-token: write - # steps: - # - uses: actions/download-artifact@v4 - # with: - # name: dist - # path: dist/ - # - uses: pypa/gh-action-pypi-publish@release/v1 + # 3. This job uses `environment: pypi` protection rule requiring manual approval. + publish: + needs: build-and-test + runs-on: ubuntu-latest + environment: pypi + permissions: + id-token: write + steps: + - uses: actions/download-artifact@v4 + with: + name: dist + path: dist/ + - uses: pypa/gh-action-pypi-publish@release/v1