[packaging] Publish to PyPI using Trusted Publishing
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 48/100
Research direction
Start by reading the linked Python Packaging User Guide section on GitHub Actions trusted publishing, then inspect this repository's release workflow and its current PyPI credentials. Done means releases use OIDC instead of a repository API-token secret and publish digital attestations to PyPI; verify the workflow configuration and release path accordingly.
Written by the indexing model from the issue text.
Description
TL;DR this will allow dropping the API token as a repo secret, making use of OIDC to upload dists to PyPI and on top of that, said dists will get digital attestations that will also end up on PyPI.
Implementation instructions: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 408
- Avg merge
- 2d 57m
- Merged PRs (30d)
- 7
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from libgit2/pygit2
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
Similar issues
-
documentation help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
simonw/sqlite-utils#872 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100