Merge pull request #39 from take-kun/ci/pypi-trusted-publisher

Use Trusted Publisher flow for uploading packages

.github/workflows/release-test.yaml

@@ -9,6 +9,13 @@ jobs:
 
     runs-on: "ubuntu-latest"
 
+    permissions:
+      id-token: write
+
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/mercapi/
+
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
@@ -19,5 +26,4 @@ jobs:
       - name: Publish to TestPyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
-          repository_url: https://test.pypi.org/legacy/
+          repository_url: https://test.pypi.org/legacy/

.github/workflows/release.yaml

@@ -12,6 +12,13 @@ jobs:
 
     runs-on: "ubuntu-latest"
 
+    permissions:
+      id-token: write
+
+    environment:
+      name: pypi
+      url: https://pypi.org/project/mercapi/
+
     steps:
       - name: Checkout sources
         uses: actions/checkout@v4
@@ -21,8 +28,6 @@ jobs:
 
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
 
       - name: Tag a commit
         run: |

pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "mercapi"
-version = "0.4.1"
+version = "0.4.2"
 description = "Python API for querying and browsing mercari.jp"
 authors = ["take-kun <[email protected]>"]
 license = "MIT"