Repository navigation
chore: publish to PyPI with trusted publishing - #305
Conversation
Publishing used long-lived PyPI and TestPyPI API tokens, passed with 'secrets: inherit' to a shared workflow on cpp-linter/.github@main. Build and publish in this repository instead, with OIDC trusted publishing from the 'pypi' and 'testpypi' environments, so no PyPI token needs to be stored. Releases still go to PyPI and manual runs on main still go to TestPyPI.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #305 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 3 3
Lines 347 347
=========================================
Hits 347 347 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 52 minutes. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
WalkthroughThe publishing workflow builds and checks a wheel, attests its provenance, and uploads the distribution. It then publishes to TestPyPI for qualifying manual runs or to PyPI for qualifying published releases. ChangesPackage publishing workflow
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~15 minutes Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly summarizes the main change: replacing token-based publishing with trusted publishing for PyPI. It is concise and directly related to the workflow changes. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Summary
Publishing used long-lived
PYPI_API_TOKEN/TEST_PYPI_TOKENsecrets, passed withsecrets: inheritto the sharedcpp-linter/.githubpy-publish.yml@main. This PR builds and publishes from this repository instead, with PyPI trusted publishing (OIDC), so no PyPI token has to be stored. This is the same setup cpp-linter and ccache-wheel use.buildjob: same wheel build andtwine checkas before, plus the build provenance attestation (contents: read,id-token: write,attestations: write).publish-pypi: runs on a published release, in thepypienvironment,id-token: writeonly.publish-testpypi: runs on a manual run onmain, in thetestpypienvironment. Same trigger as before.Before merging (maintainer)
cpp-linter-hooks→ Settings → Publishing → add a GitHub publisher: ownercpp-linter, repositorycpp-linter-hooks, workflowpublish.yml, environmentpypi. Do the same on TestPyPI with environmenttestpypi.pypi(required reviewer, deployment tags only) andtestpypi.PYPI_API_TOKENandTEST_PYPI_TOKENfrom this repo's secrets.Related Issues
None.
Summary by CodeRabbit