Use GitHub as trusted publisher for PyPI publication #2343
Conversation
strickvl
added
bug
|
Important Auto Review SkippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the To trigger a single review, invoke the WalkthroughThe project's GitHub workflows have been updated to enhance the package publishing process. Both workflows now utilize Poetry for building the package, and a new step has been introduced to mint a token specifically for publishing. The nightly workflow additionally includes a check to ensure the version matches the branch tag before release. Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
|
@coderabbitai review |
|
@strickvl, I'm ready to review the pull request. Please provide any specific instructions or areas of focus for the review, if any. Action performedReview triggered. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Status
Actionable comments generated: 2
Configuration used: .coderabbit.yaml
Files selected for processing (2)
- .github/workflows/publish_to_pypi.yml (2 hunks)
- .github/workflows/publish_to_pypi_nightly.yml (1 hunks)
Additional comments: 5
.github/workflows/publish_to_pypi.yml (3)
- 9-12: Permissions have been added to allow for trusted publishing. Ensure that the
id-token: writeandcontents: readpermissions are the minimum required and are securely managed.- 33-34: The package building process has been modified to use Poetry. Confirm that the
poetry buildcommand is correctly configured and that all necessary dependencies are installed prior to this step.- 35-37: A new step to mint a token has been introduced. Verify that the
tschm/[email protected]action is a trusted and secure action, and that it is being used correctly within the workflow..github/workflows/publish_to_pypi_nightly.yml (2)
- 49-50: The build package step for the nightly workflow has been added. Confirm that the
poetry buildcommand is correctly configured for nightly builds and that the environment is correctly set up for this step.- 51-53: A token minting step has been introduced in the nightly workflow. Verify that the
tschm/[email protected]action is a trusted and secure action, and that it is being used correctly within the workflow.
|
/fulltest |
* change publish workflow * update nightly release * delete unused script
* change publish workflow * update nightly release * delete unused script
Poetry publication using a static username and password is no longer possible. This PR makes the necessary fixes for generating a one-time token to enable publication using Poetry. See https://github.com/marketplace/actions/pypi-token-mint for more.
At some point in the future we might want to do it fully in the way that PyPi recommend but for now this should get us back in business quickly.
Summary by CodeRabbit