Change CI to use trusted publisher.

chrisstaite · Jan 1, 2025 · 346b936 · 346b936
1 parent 385488f
commit 346b936
Showing 1 changed file with 14 additions and 21 deletions.
diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
@@ -35,17 +35,16 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'created'
     needs: [ build_linux2_24_64 ]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/download-artifact@v4
       id: download
       with:
         name: manylinux2_24_64
-
     - name: Publish package to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}
         packages-dir: ${{ steps.download.outputs.download-path }}
 
   build_linux2_24_32:
@@ -72,17 +71,16 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'created'
     needs: [ build_linux2_24_32 ]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/download-artifact@v4
       id: download
       with:
         name: manylinux2_24_32
-
     - name: Publish package to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}
         packages-dir: ${{ steps.download.outputs.download-path }}
 
   build_linux2_24_aarch64:
@@ -115,17 +113,16 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'created'
     needs: [ build_linux2_24_aarch64 ]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/download-artifact@v4
       id: download
       with:
         name: manylinux2_24_aarch64
-
     - name: Publish package to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}
         packages-dir: ${{ steps.download.outputs.download-path }}
 
   build_linux2_28_64:
@@ -152,17 +149,16 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'created'
     needs: [ build_linux2_28_64 ]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/download-artifact@v4
       id: download
       with:
         name: manylinux2_28_64
-
     - name: Publish package to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}
         packages-dir: ${{ steps.download.outputs.download-path }}
 
   build_linux2_28_aarch64:
@@ -195,17 +191,16 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'created'
     needs: [ build_linux2_28_aarch64 ]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/download-artifact@v4
       id: download
       with:
         name: manylinux2_28_aarch64
-
     - name: Publish package to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}
         packages-dir: ${{ steps.download.outputs.download-path }}
 
   build_mac:
@@ -248,17 +243,16 @@ jobs:
       matrix:
         python-version: ['3.8', '3.9', '3.10', '3.11', '3.12', '3.13']
         arch: ['arm64', 'x86_64']
+    permissions:
+      id-token: write
     steps:
     - uses: actions/download-artifact@v4
       id: download
       with:
         name: mac_${{ matrix.arch }}_${{ matrix.python-version }}
-
     - name: Publish package to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}
         packages-dir: ${{ steps.download.outputs.download-path }}
 
   build_windows:
@@ -308,15 +302,14 @@ jobs:
       matrix:
         python-version: ['3.8', '3.9', '3.10', '3.11', '3.12', '3.13']
         python-arch: ['x86', 'x64']
+    permissions:
+      id-token: write
     steps:
     - uses: actions/download-artifact@v4
       id: download
       with:
         name: windows_${{ matrix.python-arch }}_${{ matrix.python-version }}
-
     - name: Publish package to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}
         packages-dir: ${{ steps.download.outputs.download-path }}