From aa1880221479431144419693d94caffed11285e1 Mon Sep 17 00:00:00 2001 From: johnnynunez Date: Thu, 11 Jun 2026 19:18:23 +0200 Subject: [PATCH] ci: publish wheels to PyPI on version tags via Trusted Publishing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit New publish-pypi job: on v* tags (after build + codegen compile checks pass) the sdist+wheel are uploaded to PyPI with pypa/gh-action-pypi-publish using OIDC Trusted Publishing — no API tokens or secrets stored in GitHub. One-time setup required on pypi.org (documented in the workflow): add a pending publisher for project 'fkl-python' pointing at this repository, workflow wheels.yml, environment 'pypi'. The 'fkl-python' name is currently unclaimed on PyPI (verified via the simple index). skip-existing=true makes tag re-runs idempotent; the GitHub Release job is unchanged and runs in parallel. --- .github/workflows/wheels.yml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index 01d3d2a..0ae8040 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -170,3 +170,33 @@ jobs: with: files: dist/* generate_release_notes: true + + publish-pypi: + name: Publish to PyPI + needs: [build, codegen-compile-check] + if: startsWith(github.ref, 'refs/tags/v') + runs-on: ubuntu-latest + environment: + name: pypi + url: https://pypi.org/p/fkl-python + permissions: + id-token: write # OIDC token for PyPI Trusted Publishing (no API keys) + steps: + - uses: actions/download-artifact@v4 + with: + name: dist + path: dist + + # Trusted Publishing: PyPI trusts this repo+workflow+environment via + # OIDC. One-time setup on pypi.org (no secrets stored in GitHub): + # PyPI -> Your projects -> Publishing -> Add a new pending publisher + # project: fkl-python + # owner: + # repository: fkl_python + # workflow: wheels.yml + # environment: pypi + - name: Publish to PyPI (trusted publishing) + uses: pypa/gh-action-pypi-publish@release/v1 + with: + packages-dir: dist + skip-existing: true