ci: authenticate to PyPI with OIDC for publishing artifacts

claranet · Oct 10, 2023 · a603019 · a603019
1 parent da2c3d2
commit a603019
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -12,6 +12,8 @@ jobs:
   Release:
     environment: release
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
 
     steps:
       - name: Checkout code
@@ -40,15 +42,13 @@ jobs:
           [[ "$(poetry version --short)" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] \
             || echo "prerelease=true" >> "$GITHUB_OUTPUT"
 
-      - name: Create Release
+      - name: Create GitHub release
         uses: ncipollo/release-action@v1
         with:
           artifacts: "dist/*"
           token: ${{ secrets.GITHUB_TOKEN }}
           draft: false
           prerelease: ${{ steps.check-version.outputs.prerelease == 'true' }}
 
-      - name: Publish to PyPI
-        env:
-          POETRY_PYPI_TOKEN_PYPI: ${{ secrets.PYPI_TOKEN }}
-        run: poetry publish
+      - name: Publish release distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1