From 914a444537a72f5d8e2b09047ee9ffb849a91ad4 Mon Sep 17 00:00:00 2001 From: Anthony Volk <14987227+anth-volk@users.noreply.github.com> Date: Mon, 12 Oct 2026 17:33:21 +0400 Subject: [PATCH 1/2] Publish to PyPI with trusted publishing Run the PyPI upload in the pypi environment with an OIDC token instead of the shared org-wide PYPI API token, and add a patch changelog entry so merging cuts a release through the new path. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/versioning.yaml | 8 ++++++-- changelog_entry.yaml | 4 ++++ 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/versioning.yaml b/.github/workflows/versioning.yaml index dc19175..d6d5044 100644 --- a/.github/workflows/versioning.yaml +++ b/.github/workflows/versioning.yaml @@ -47,6 +47,12 @@ jobs: name: Publish to PyPI if: (github.event.head_commit.message == 'Update package version') runs-on: ubuntu-latest + # PyPI trusted publishing: uploads accepted only from this workflow in + # the pypi environment (limited to main). No stored token. + environment: pypi + permissions: + contents: write # publish-git-tag.sh pushes the release tag + id-token: write # OIDC token for PyPI trusted publishing steps: - name: Checkout code uses: actions/checkout@v6 @@ -65,6 +71,4 @@ jobs: - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: - user: __token__ - password: ${{ secrets.PYPI }} skip-existing: true diff --git a/changelog_entry.yaml b/changelog_entry.yaml index e69de29..b7c1ccc 100644 --- a/changelog_entry.yaml +++ b/changelog_entry.yaml @@ -0,0 +1,4 @@ +- bump: patch + changes: + changed: + - Publish to PyPI with trusted publishing (OIDC) instead of a stored API token. From 0cdb70938acf61962bc6063f977ba3e6e7781a97 Mon Sep 17 00:00:00 2001 From: Anthony Volk <14987227+anth-volk@users.noreply.github.com> Date: Mon, 12 Oct 2026 22:29:38 +0400 Subject: [PATCH 2/2] Build the release without the dev extras The publish job ran make install (pip install -e .[dev]), and the dev extras pin policyengine-us==1.667.1, which is no longer on PyPI, so the job would fail before uploading. Building the wheel needs only the build tool. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/versioning.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/versioning.yaml b/.github/workflows/versioning.yaml index d6d5044..058337c 100644 --- a/.github/workflows/versioning.yaml +++ b/.github/workflows/versioning.yaml @@ -62,8 +62,10 @@ jobs: uses: actions/setup-python@v6 with: python-version: 3.13 - - name: Install package - run: make install + # Building the wheel needs only the build tool. The dev extras pin + # policyengine-us==1.667.1, which is no longer on PyPI. + - name: Install build tool + run: pip install build - name: Build package run: python -m build - name: Publish a git tag