feat: use pypi trusted publisher (#133)

Signed-off-by: Henry Schreiner <[email protected]>
scientific-python · May 2, 2023 · 9def9c9 · 9def9c9
1 parent 64aa9b0
commit 9def9c9
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 14 deletions.
diff --git a/{{cookiecutter.project_name}}/.github/workflows/ci.yml b/{{cookiecutter.project_name}}/.github/workflows/ci.yml
@@ -84,9 +84,9 @@ jobs:
   {%- if not compiled %}
 
   dist:
+    needs: [pre-commit]
     name: Distribution build
     runs-on: ubuntu-latest
-    needs: [pre-commit]
 
     steps:
       - uses: actions/checkout@v3
@@ -107,12 +107,26 @@ jobs:
 
       {%- endif %}
 
-      - uses: pypa/[email protected]
+  publish:
+    needs: [dist]
+    name: Publish to PyPI
+    environment: pypi
+    permissions:
+      id-token: write
+    runs-on: ubuntu-latest
+    if: github.event_name == 'release' && github.event.action == 'published'
+
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: artifact
+          path: dist
+
+      - uses: pypa/gh-action-pypi-publish@release/v1
         if: github.event_name == 'release' && github.event.action == 'published'
         with:
-          # Remember to generate this and set it in "GitHub Secrets"
-          password: {% raw %}${{ secrets.pypi_password }}{% endraw %}
-          # Remove this line
+          # Remember to tell (test-)pypi about this repo before publishing
+          # Remove this line to publish to PyPI
           repository-url: https://test.pypi.org/legacy/
           {%- if cookiecutter.project_type == "trampolim" %}
           # Check not supported currently by twine + trampolim

diff --git a/{{cookiecutter.project_name}}/.github/workflows/wheels-pybind11,skbuild,mesonpy,maturin.yml b/{{cookiecutter.project_name}}/.github/workflows/wheels-pybind11,skbuild,mesonpy,maturin.yml
@@ -42,7 +42,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: pypa/cibuildwheel@v2.11.1
+      - uses: pypa/cibuildwheel@v2.12.3
 
       - name: Upload wheels
         uses: actions/upload-artifact@v3
@@ -51,6 +51,9 @@ jobs:
 
   upload_all:
     needs: [build_wheels, make_sdist]
+    environment: pypi
+    permissions:
+      id-token: write
     runs-on: ubuntu-latest
     if: github.event_name == 'release' && github.event.action == 'published'
 
@@ -60,9 +63,8 @@ jobs:
           name: artifact
           path: dist
 
-      - uses: pypa/gh-action-pypi-publish@v1.8.3
+      - uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          # Remember to generate this and set it in "GitHub Secrets"
-          password: {% raw %}${{ secrets.pypi_password }}{% endraw %}
-          # Remove this line
+          # Remember to tell (test-)pypi about this repo before publishing
+          # Remove this line to publish to PyPI
           repository-url: https://test.pypi.org/legacy/
diff --git a/{{cookiecutter.project_name}}/.pre-commit-config.yaml b/{{cookiecutter.project_name}}/.pre-commit-config.yaml
@@ -42,10 +42,10 @@ repos:
     rev: "1.13.0"
     hooks:
       - id: blacken-docs
-        additional_dependencies: [black==23.1.0]
+        additional_dependencies: [black==23.3.0]
 
   - repo: https://github.com/charliermarsh/ruff-pre-commit
-    rev: "v0.0.260"
+    rev: "v0.0.264"
     hooks:
       - id: ruff
         args: ["--fix", "--show-fixes"]
@@ -63,15 +63,15 @@ repos:
 {%- if cookiecutter.project_type in ["pybind11", "skbuild", "mesonpy"] %}
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: "v14.0.6"
+    rev: "v16.0.2"
     hooks:
       - id: clang-format
         types_or: [c++, c, cuda]
 
 {%- endif %}
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: "v1.1.1"
+    rev: "v1.2.0"
     hooks:
       - id: mypy
         files: src|tests