diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index 62f24c6..a165b6a 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -37,9 +37,43 @@ jobs: with: password: ${{ secrets.TEST_PYPI_API_TOKEN }} repository_url: https://test.pypi.org/legacy/ - # - name: Publish distribution 📦 to PyPI # if: startsWith(github.ref, 'refs/tags') # uses: pypa/gh-action-pypi-publish@release/v1 # with: # password: ${{ secrets.PYPI_API_TOKEN }} + + +# Attempt to do this wiht a trusted publisher + pypi-publish: + name: Upload release to PyPI + runs-on: ubuntu-latest + environment: + name: pypi + url: https://pypi.org/p/autofish + permissions: + id-token: write # IMPORTANT: this permission is mandatory for trusted publishing + + steps: + - uses: actions/checkout@main + - name: Set up Python 3.10 + uses: actions/setup-python@v3 + with: + python-version: "3.10" + - name: Install pypa/build + run: >- + python -m + pip install + build + --user + - name: Build a binary wheel and a source tarball + run: >- + python -m + build + --sdist + --wheel + --outdir dist/ + - name: Publish package distributions to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + +