From cbd6d01d855e02aab0908c7709d5c0ddc88c617a Mon Sep 17 00:00:00 2001 From: Sviatoslav Sydorenko Date: Sat, 7 Dec 2024 05:17:14 +0100 Subject: [PATCH] =?UTF-8?q?=F0=9F=93=9DFix=20a=20typo=20in=20"privileges"?= =?UTF-8?q?=20@=20README?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 59689b1..8ddf0d7 100644 --- a/README.md +++ b/README.md @@ -212,7 +212,7 @@ Invoking `pypi-publish` from composite actions is unsupported. It is not tested. GitHub Runners have limitations and bugs in this case. But more importantly, this is usually an indication of using it insecurely. When using [Trusted Publishing][trusted publisher], it is imperative to keep -build machinery invocation in a separate job with restrictive priviliges +build machinery invocation in a separate job with restrictive privileges as [Trusted Publishing][trusted publisher] itself requires elevated permissions to make use of OIDC. Our observation is that the users sometimes create in-project composite actions that invoke building and