From 14d4b50ca891960b42acc64964fb23ac7893ec3b Mon Sep 17 00:00:00 2001 From: Ry Jones Date: Thu, 23 Jul 2026 11:24:40 -0700 Subject: [PATCH] Add PyPI trusted publishing workflow Publishes sdist and wheel to PyPI via OIDC trusted publishing when a release tag (e.g. 0.16.1) is pushed. Build and publish run as separate jobs so id-token: write is scoped to the publish job only, and all actions are pinned to the commit SHA of their latest release. Co-Authored-By: Claude Fable 5 Signed-off-by: Ry Jones --- .github/workflows/publish_pypi.yml | 46 ++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/publish_pypi.yml diff --git a/.github/workflows/publish_pypi.yml b/.github/workflows/publish_pypi.yml new file mode 100644 index 0000000..bc34c72 --- /dev/null +++ b/.github/workflows/publish_pypi.yml @@ -0,0 +1,46 @@ +name: Publish to PyPI + +on: + push: + tags: + - "[0-9]+.[0-9]+.[0-9]+" + +permissions: + contents: read + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Install uv + uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + with: + version: "latest" + + - name: Build sdist and wheel + run: uv build + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: dist + path: dist/ + + publish: + needs: build + runs-on: ubuntu-latest + environment: + name: pypi + url: https://pypi.org/project/liboqs-python/ + permissions: + id-token: write + + steps: + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: dist + path: dist/ + + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1