Add secure PyPI trusted publishing workflow - #8
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3384323884
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| on: | ||
| workflow_dispatch: |
There was a problem hiding this comment.
A default dispatch checks out main and publishes its currently unreleased 0.2.1 artifact without requiring the protected v0.2.1 tag mandated by ROADMAP.md:88-92 and VERSIONING.md:31. This also permits selecting another branch: gh workflow run --help documents --ref as the “Branch or tag name which contains the version of the workflow file” (upstream manual). Consequently, an approved run from an untagged or modified ref can publish bytes that never passed the tag-based release gate; reject non-release-tag refs and validate that the tag matches the package version before granting the publish job OIDC access.
Useful? React with 👍 / 👎.
1 participant
Summary
Adds a manual, secretless PyPI release workflow for the installable specification package.
id-token: writeonly to the PyPI publish jobpypiGitHub environmentValidation
actionlint v1.7.12 .github/workflows/publish.ymlpython -m pytest -q: 6 passed, 2 subtests passedpython tools/validate_repository.pypython -m buildpython -m twine check dist/*PyPI pending publisher
Configure these exact values before the first workflow run:
openstatspec-specificationOpenStatSpecspecificationpublish.ymlpypiThe workflow is intentionally manual so publishing remains an explicit release action.