From da3a80e381f090ff20af5fa6fcc6e015420a86d5 Mon Sep 17 00:00:00 2001 From: Panadestein Date: Tue, 13 Oct 2026 10:32:25 +0200 Subject: [PATCH 1/2] =?UTF-8?q?ci(deploy):=20=E2=9C=A8=20publish=20to=20Py?= =?UTF-8?q?PI=20via=20trusted=20publishing,=20drop=20AWS=20CodeArtifact?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds `upload_pypi` (on a published release) and `upload_testpypi` (manual dry run) jobs using PyPI's trusted publishing (OIDC): no API token is stored in the repository. Removes the AWS CodeArtifact upload and its `force-upload` input; we no longer deploy there. Each job needs a GitHub environment with a matching trusted publisher configured on (test.)pypi.org; `pypi` should also require a reviewer, since a release there cannot be undone. Assisted-by: GitHub Copilot:Claude Opus 5.5 --- .github/workflows/deploy.yml | 65 ++++++++++++++++++++++++++---------- sandbox_commit_msg.txt | 10 ++++++ 2 files changed, 58 insertions(+), 17 deletions(-) create mode 100644 sandbox_commit_msg.txt diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 283ff67..8c76745 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -1,10 +1,10 @@ -name: Publish src_method Python sdist and wheels to Algorithmiq PyPI +name: Publish src_method Python sdist and wheels on: workflow_dispatch: inputs: - force-upload: - description: 'Upload artifacts without a corresponding release' + publish-testpypi: + description: 'Upload artifacts to TestPyPI without a corresponding release' required: false default: false type: boolean @@ -57,17 +57,22 @@ jobs: dist/*.whl - upload_codeartifact: - name: Upload to AWS CodeArtifact + upload_testpypi: + name: Upload to TestPyPI needs: - build-sdist-wheel - if: (github.event_name == 'release' && github.event.action == 'published') || github.event.inputs.force-upload + if: github.event.inputs.publish-testpypi runs-on: ubuntu-latest + # Requires a `testpypi` environment (Settings > Environments) with a Trusted + # Publisher configured on https://test.pypi.org for this repo and workflow. + environment: + name: testpypi + url: https://test.pypi.org/project/src_method/ + permissions: - id-token: write - contents: read + id-token: write # for PyPI's trusted publishing (OIDC); no token is stored steps: - uses: actions/download-artifact@v8 @@ -77,14 +82,40 @@ jobs: path: dist merge-multiple: true - - uses: aws-actions/configure-aws-credentials@v6 + - name: Publish to TestPyPI + uses: pypa/gh-action-pypi-publish@release/v1 with: - role-to-assume: arn:aws:iam::406960181794:role/github-actions-codeartifact-write-access - aws-region: eu-west-1 + repository-url: https://test.pypi.org/legacy/ + # TestPyPI is a shared sandbox: don't fail if this exact version is + # already there from a previous dry run. + skip-existing: true - - name: Publish - run: | - export TWINE_USERNAME=aws - export TWINE_PASSWORD="$(aws codeartifact get-authorization-token --domain algorithmiq --domain-owner 406960181794 --region eu-west-1 --query authorizationToken --output text)" - export TWINE_REPOSITORY_URL="$(aws codeartifact get-repository-endpoint --domain algorithmiq --domain-owner 406960181794 --repository pypi --region eu-west-1 --format pypi --query repositoryEndpoint --output text)" - pipx run twine upload dist/* + + upload_pypi: + name: Upload to PyPI + needs: + - build-sdist-wheel + if: github.event_name == 'release' && github.event.action == 'published' + + runs-on: ubuntu-latest + + # Requires a `pypi` environment (Settings > Environments) with a Trusted + # Publisher configured on https://pypi.org for this repo and workflow, and + # ideally required reviewers, since a release here cannot be undone. + environment: + name: pypi + url: https://pypi.org/project/src_method/ + + permissions: + id-token: write # for PyPI's trusted publishing (OIDC); no token is stored + + steps: + - uses: actions/download-artifact@v8 + with: + # unpacks all CIBW artifacts into dist/ + pattern: cibw-* + path: dist + merge-multiple: true + + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 diff --git a/sandbox_commit_msg.txt b/sandbox_commit_msg.txt new file mode 100644 index 0000000..c539058 --- /dev/null +++ b/sandbox_commit_msg.txt @@ -0,0 +1,10 @@ +ci(deploy): ✨ publish to PyPI via trusted publishing + +Adds `upload_pypi` (on a published release) and `upload_testpypi` (manual dry +run) jobs alongside the existing AWS CodeArtifact upload, both using PyPI's +trusted publishing (OIDC): no API token is stored in the repository. Each +needs a GitHub environment with a matching trusted publisher configured on +(test.)pypi.org; `pypi` should also require a reviewer, since a release there +cannot be undone. + +Assisted-by: GitHub Copilot:Claude Opus 5.5 From cbc671c6860fc050c153da963fc444348471198a Mon Sep 17 00:00:00 2001 From: Panadestein Date: Tue, 13 Oct 2026 10:51:45 +0200 Subject: [PATCH 2/2] =?UTF-8?q?ci(deploy):=20=F0=9F=94=A5=20drop=20the=20T?= =?UTF-8?q?estPyPI=20dry-run=20job?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit One less environment to configure; publishing straight to PyPI on release. Assisted-by: GitHub Copilot:Claude Opus 5.5 --- .github/workflows/deploy.yml | 41 ------------------------------------ sandbox_commit_msg.txt | 10 --------- 2 files changed, 51 deletions(-) delete mode 100644 sandbox_commit_msg.txt diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 8c76745..b00bb37 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -1,13 +1,6 @@ name: Publish src_method Python sdist and wheels on: - workflow_dispatch: - inputs: - publish-testpypi: - description: 'Upload artifacts to TestPyPI without a corresponding release' - required: false - default: false - type: boolean release: types: - published @@ -57,40 +50,6 @@ jobs: dist/*.whl - upload_testpypi: - name: Upload to TestPyPI - needs: - - build-sdist-wheel - if: github.event.inputs.publish-testpypi - - runs-on: ubuntu-latest - - # Requires a `testpypi` environment (Settings > Environments) with a Trusted - # Publisher configured on https://test.pypi.org for this repo and workflow. - environment: - name: testpypi - url: https://test.pypi.org/project/src_method/ - - permissions: - id-token: write # for PyPI's trusted publishing (OIDC); no token is stored - - steps: - - uses: actions/download-artifact@v8 - with: - # unpacks all CIBW artifacts into dist/ - pattern: cibw-* - path: dist - merge-multiple: true - - - name: Publish to TestPyPI - uses: pypa/gh-action-pypi-publish@release/v1 - with: - repository-url: https://test.pypi.org/legacy/ - # TestPyPI is a shared sandbox: don't fail if this exact version is - # already there from a previous dry run. - skip-existing: true - - upload_pypi: name: Upload to PyPI needs: diff --git a/sandbox_commit_msg.txt b/sandbox_commit_msg.txt deleted file mode 100644 index c539058..0000000 --- a/sandbox_commit_msg.txt +++ /dev/null @@ -1,10 +0,0 @@ -ci(deploy): ✨ publish to PyPI via trusted publishing - -Adds `upload_pypi` (on a published release) and `upload_testpypi` (manual dry -run) jobs alongside the existing AWS CodeArtifact upload, both using PyPI's -trusted publishing (OIDC): no API token is stored in the repository. Each -needs a GitHub environment with a matching trusted publisher configured on -(test.)pypi.org; `pypi` should also require a reviewer, since a release there -cannot be undone. - -Assisted-by: GitHub Copilot:Claude Opus 5.5