Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[TODO] Migrate the release process to Trusted Publishing #2147

Open
webknjaz opened this issue Dec 16, 2024 · 1 comment · May be fixed by #2149
Open

[TODO] Migrate the release process to Trusted Publishing #2147

webknjaz opened this issue Dec 16, 2024 · 1 comment · May be fixed by #2149
Assignees
@jezdez @webknjaz
Labels
ci Related to continuous integration tasks maintenance Related to maintenance processes packaging Packaging related stuff refactor Refactoring code

Comments

@webknjaz
Copy link
Member

This will enable publishing digital attestations and using short-lived secrets.

If implemented right, this will preserve the ability for release managers to verify the dists before publishing them.

https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/ shows how to do this.
@webknjaz webknjaz added refactor Refactoring code maintenance Related to maintenance processes ci Related to continuous integration tasks packaging Packaging related stuff labels Dec 16, 2024
@webknjaz webknjaz self-assigned this Dec 16, 2024
@webknjaz webknjaz moved this to 🗒️ Backlog 📝 in 📅 Procrastinating in public Dec 16, 2024
@webknjaz
Copy link
Member Author

@jezdez this is something we talked about two PyCons ago, in SLC. Let's make it happen.

IIRC, the main concern was that ability to preview the dists before forwarding them to PyPI. It's now fully possible relatively easily.

This will require some repo+PyPI configuration from you.

@webknjaz webknjaz mentioned this issue Dec 16, 2024
Open
webknjaz added a commit to webknjaz/pip-tools that referenced this issue Dec 17, 2024
@webknjaz
📦 Migrate release workflow to Trusted Publishing
f594ed7 
Resolves jazzband#2147.
@webknjaz webknjaz linked a pull request Dec 17, 2024 that will close this issue
Open
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jezdez jezdez

@webknjaz webknjaz

Labels
ci Related to continuous integration tasks maintenance Related to maintenance processes packaging Packaging related stuff refactor Refactoring code
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

📦 Migrate release workflow to Trusted Publishing webknjaz/pip-tools
2 participants
@jezdez @webknjaz