ci: Use Trusted Publisher flow for uploading packages

take-kun · Nov 10, 2024 · 3dbe756 · 3dbe756
1 parent edd78f8
commit 3dbe756
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 4 deletions.
diff --git a/.github/workflows/release-test.yaml b/.github/workflows/release-test.yaml
@@ -9,6 +9,13 @@ jobs:
 
     runs-on: "ubuntu-latest"
 
+    permissions:
+      id-token: write
+
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/mercapi/
+
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
@@ -19,5 +26,4 @@ jobs:
       - name: Publish to TestPyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-          repository_url: https://test.pypi.org/legacy/
+          repository_url: https://test.pypi.org/legacy/
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -12,6 +12,13 @@ jobs:
 
     runs-on: "ubuntu-latest"
 
+    permissions:
+      id-token: write
+
+    environment:
+      name: pypi
+      url: https://pypi.org/project/mercapi/
+
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
@@ -21,8 +28,6 @@ jobs:
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
 
       - name: Tag a commit
         run: |