From 869551cfe33514e8035aeac35c6078482d0fd04d Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Tue, 9 Dec 2025 22:17:34 -0800 Subject: [PATCH] feat(ci): switch to uv publish for PyPI uploads Signed-off-by: William Woodruff --- .github/workflows/pypi-publish.yml | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml index e0f85bd50f02..68c5ae83130d 100644 --- a/.github/workflows/pypi-publish.yml +++ b/.github/workflows/pypi-publish.yml @@ -51,13 +51,16 @@ jobs: - run: | find tmpdist/ -type f -name 'cryptography*' -exec mv {} dist/ \; + - uses: astral-sh/attest-action@2c727738cea36d6c97dd85eb133ea0e0e8fe754b # v0.0.4 + # Do not perform attestation for things for TestPyPI. This is + # because there's nothing that would prevent a malicious PyPI from + # serving a signed TestPyPI asset in place of a release intended for + # PyPI. + if: env.PYPI_URL == 'https://upload.pypi.org/legacy/' + - name: Publish package distributions to PyPI - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 - with: - repository-url: ${{ env.PYPI_URL }} - skip-existing: true - # Do not perform attestation for things for TestPyPI. This is - # because there's nothing that would prevent a malicious PyPI from - # serving a signed TestPyPI asset in place of a release intended for - # PyPI. - attestations: ${{ env.PYPI_URL == 'https://upload.pypi.org/legacy/' }} + # uv is present because attest-action installs it. + run: | + uv publish --trusted-publishing=always dist/* + env: + UV_PUBLISH_URL: ${{ env.PYPI_URL }}