Secure publish pipeline (#101)

inverse · Jan 17, 2024 · 5b649c1 · 5b649c1
1 parent 4fe7c03
commit 5b649c1
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -7,6 +7,11 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-20.04
+    environment:
+      name: pypi
+      url: https://pypi.org/p/cert-host-scraper
+    permissions:
+      id-token: write
     steps:
     - uses: actions/checkout@master
     - uses: actions/setup-python@v5
@@ -24,6 +29,3 @@ jobs:
         poetry build
     - name: Publish to PyPI
       uses: pypa/[email protected]
-      with:
-        user: __token__
-        password: ${{ secrets.pypi_token }}