Repository navigation
ci(deploy): ✨ publish to PyPI via trusted publishing - #61
Merged
Merged
Conversation
…tifact Adds `upload_pypi` (on a published release) and `upload_testpypi` (manual dry run) jobs using PyPI's trusted publishing (OIDC): no API token is stored in the repository. Removes the AWS CodeArtifact upload and its `force-upload` input; we no longer deploy there. Each job needs a GitHub environment with a matching trusted publisher configured on (test.)pypi.org; `pypi` should also require a reviewer, since a release there cannot be undone. Assisted-by: GitHub Copilot:Claude Opus 5.5
One less environment to configure; publishing straight to PyPI on release. Assisted-by: GitHub Copilot:Claude Opus 5.5
Panadestein
marked this pull request as ready for review
October 13, 2026 08:52
Contributor
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The workflow correctly configures release-only PyPI trusted publishing without stored credentials.
0 open findings
What changed in this PR
Replaces AWS CodeArtifact deployment with PyPI trusted publishing via OIDC.
Changes:
- Removes manual forced uploads and AWS authentication.
- Adds a protected
pypienvironment and trusted publishing action. - Reuses the existing release artifact build.
| File | Description |
|---|---|
.github/workflows/deploy.yml |
Publishes release artifacts directly to PyPI using OIDC. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 AI text below 🤖
Publishes
src_methodto the real, public PyPI, through PyPI's trusted publishing (OIDC): no API token is generated or stored anywhere. This replaces the AWS CodeArtifact upload, which is dropped along with itsforce-uploadinput.What this adds
upload_pypi: runs when a GitHub release is published, uploads the already-built sdist and wheel topypi.org.Reuses the existing
build-sdist-wheeljob; nothing about the build changes.Setup needed before this can publish (not part of this PR)
src_methodthere first, or use PyPI's "pending publisher" feature to register the trusted publisher before the project exists; the first successful publish then creates it.Algorithmiq, repositorysrc-method, workflow filedeploy.yml, environmentpypi.pypiGitHub environment (repo Settings > Environments), ideally with required reviewers, since publishing a version to PyPI cannot be undone (only yanked).Until that setup exists, the job will fail (no matching trusted publisher), but nothing else in this PR depends on it.