From 00e7851770dcd1cee64b4b08310e9a626925fe41 Mon Sep 17 00:00:00 2001 From: Corentin Cadiou Date: Mon, 18 Mar 2024 13:27:00 +0100 Subject: [PATCH 1/2] Move away from using tokens See https://github.com/pypa/gh-action-pypi-publish/tree/v1.8.14/ --- .github/workflows/wheels.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/wheels.yaml b/.github/workflows/wheels.yaml index f68e7d88..be3f25d3 100644 --- a/.github/workflows/wheels.yaml +++ b/.github/workflows/wheels.yaml @@ -63,6 +63,11 @@ jobs: runs-on: ubuntu-latest # upload to PyPI on every tag starting with 'yt_astro_analysis-' if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/yt_astro_analysis-') + environment: + name: pypi + url: https://pypi.org/p/yt-astro-analysis + permissions: + id-token: write steps: - uses: actions/download-artifact@v4 with: @@ -76,6 +81,3 @@ jobs: merge-multiple: true - uses: pypa/gh-action-pypi-publish@v1.8.14 - with: - user: __token__ - password: ${{ secrets.pypi_token }} From ad2d8ce01f55fbd484241aae0bdd00c9c2cabe04 Mon Sep 17 00:00:00 2001 From: Corentin Cadiou Date: Mon, 18 Mar 2024 15:58:38 +0100 Subject: [PATCH 2/2] Match environment name with value on PyPi --- .github/workflows/wheels.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/wheels.yaml b/.github/workflows/wheels.yaml index be3f25d3..0ad284b4 100644 --- a/.github/workflows/wheels.yaml +++ b/.github/workflows/wheels.yaml @@ -64,7 +64,7 @@ jobs: # upload to PyPI on every tag starting with 'yt_astro_analysis-' if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/yt_astro_analysis-') environment: - name: pypi + name: upload_pypi url: https://pypi.org/p/yt-astro-analysis permissions: id-token: write