actions/pypi-publish
1
0
Fork 0
mirror of https://github.com/pypa/gh-action-pypi-publish.git synced 2024-12-28 18:04:50 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

🎨 Show GH environments use in README examples

Browse source 
It is a useful protection feature giving the end-users more control
over the release flow and trust.
This commit is contained in:
Sviatoslav Sydorenko 2023-04-24 07:04:43 +02:00
parent 3b6670b0bd
commit 7a1a355fb5
WARNING! Although there is a key with this ID in the database it does not verify this commit! This commit is SUSPICIOUS.
GPG key ID: 9345E8FEA89CA455
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -86,6 +86,9 @@ jobs:
pypi-publish:
name: Upload release to PyPI
runs-on: ubuntu-latest
environment:
name: pypi
url: https://pypi.org/p/<your-pypi-project-name>
permissions:
id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
steps:
@ -103,6 +106,7 @@ Other indices that support trusted publishing can also be used, like TestPyPI:
with:
repository-url: https://test.pypi.org/legacy/
```
_(don't forget to update the environment name to `testpypi` or similar!)_
> **Pro tip**: only set the `id-token: write` permission in the job that does
> publishing, not globally. Also, try to separate building from publishing