From 4c9562434b15430b022d4229ed90f79ea1526dec Mon Sep 17 00:00:00 2001 From: Sait Cakmak Date: Thu, 29 Oct 2026 09:34:09 -0700 Subject: [PATCH] Use PyPI Trusted Publishing for releases Summary: ## What Changed - Grant the `deploy` job `id-token: write` for PyPI OIDC and explicitly retain `contents: read` for checkout. - Remove the `user` and `password` publishing inputs, including the `PYPI_TOKEN` secret reference. - Preserve the pinned publishing action, release triggers, test dependency, and TestPyPI workflow. The production PyPI trusted publisher has already been registered by the author. This updates the internal source of OSS `.github/workflows/deploy.yml`. Differential Revision: D128356370 --- .github/workflows/deploy.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 84bd63b29a2..4071b4b7e83 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -31,6 +31,9 @@ jobs: deploy: needs: tests-and-coverage-pinned # only run if test step succeeds runs-on: ubuntu-latest + permissions: + contents: read + id-token: write env: # `uv pip ...` requires venv by default. This skips that requirement. UV_SYSTEM_PYTHON: 1 @@ -55,6 +58,4 @@ jobs: - name: Deploy to PyPI uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1.13 with: - user: __token__ - password: ${{ secrets.PYPI_TOKEN }} verbose: true