fix: enable trusted PyPI publishing - #4
Conversation
Signed-off-by: Kuberhealthy Coder <kuberhealthy-coder[bot]@users.noreply.github.com>
|
Eric Greer (@integrii) This workflow change is in scope and the build/DCO checks pass. Feasibility is contingent on the |
![kuberhealthy-code-reviewer[bot]](https://avatars.githubusercontent.com/in/4015246?s=60&v=4){kind=small}
There was a problem hiding this comment.
Reviewed exact head aba7bab5393dd1e2aaf9292da3f5132d2c06ed4a. No code findings: the workflow correctly enables GitHub OIDC with id-token: write and removes token-based PyPI credentials. Build and DCO checks pass.
Next steps: confirm the kuberhealthy-client PyPI trusted publisher is configured for this repository and .github/workflows/publish.yml, then obtain maintainer authorization before merge. I am not approving until that external prerequisite is confirmed.
Summary
id-token: writeto the PyPI publish jobPYPI_API_TOKENcredentials so PyPA trusted publishing is usedValidation
git diff --checkpassed34905805077confirmed the prior missing OIDC permissionMaintainer approval is required before merge. PyPI trusted publisher configuration must match this repository/workflow.