CI: publish to PyPI with trusted publishing instead of pinned flit and a long-lived token

Aperta
  • Qualcosa non va?
#975 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
65/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
github-actions, python
Ambito
ci-cd, devops, release

Direzione di ricerca

Start with the publish job in .github/workflows/ci.yml and review how it depends on the test matrix and the manual tag dispatch path from #974. Confirm the PyPI publisher registration, then run the workflow through a release path using python -m build and pypa/gh-action-pypi-publish. Done means a tagged release publishes successfully through trusted publishing and PYPI_TOKEN is removed.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

CI infrastructure

The v0.12.0 publish failed on its first attempt (run 35960284940): the job installs flit~=3.6, which resolves to flit 3.12.0, and that release only requires flit_core>=3.12.0 with no upper bound, so pip paired it with flit_core 4.1.0 (the 4.x series started in August 2026), which dropped the gen_setup_py argument flit 3.x still passes. #974 pinned both to the 3.12 series and added a workflow_dispatch path that publishes an existing tag, and a manual dispatch (run 35970324623) got 0.12.0 out. The job still depends on version pins that will need attention again, and on the long-lived PYPI_TOKEN repository secret.

Proposal. Build with python -m build and upload with pypa/gh-action-pypi-publish using PyPI trusted publishing (OIDC). That removes the flit pins, retires the token, and the id-token: write permission makes it explicit which job may publish. The manual dispatch path from #974 should be kept: it checks out refs/tags/<input>, so only an existing tag can be published.

Steps.

  1. On the PyPI project, register a GitHub publisher: owner QuantEcon, repository QuantEcon.py, workflow ci.yml, optionally a pypi environment if we want an approval gate before upload. This needs a PyPI project owner.
  2. In .github/workflows/ci.yml, give the publish job permissions: id-token: write (and contents: read), replace the "Install flit" and "Build and publish" steps with pip install build, python -m build, and the pypa/gh-action-pypi-publish action.
  3. After the next release has gone through the new path, delete PYPI_TOKEN from the repository secrets.

The publish job is gated on the test matrix (needs: [tests]) and that should stay as it is.

Lingua principale
Python
Stelle
2.4k
Fork
2.3k
Merge medio
1g 2h
PR unite (30g)
10

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di QuantEcon/QuantEcon.py

Tutte le issue di QuantEcon/QuantEcon.py

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.