chore(ci): publish to PyPI with Trusted Publishing / OIDC (GC1-104) - #281
Open
pmichalina-groq wants to merge 1 commit into
Open
chore(ci): publish to PyPI with Trusted Publishing / OIDC (GC1-104)#281pmichalina-groq wants to merge 1 commit into
pmichalina-groq wants to merge 1 commit into
Conversation
Replace token-based publishing with PyPI Trusted Publishing: - publish-pypi workflow builds with rye, then uploads with pypa/gh-action-pypi-publish (pinned to v1.14.2). The job gets id-token: write and no longer reads a PYPI_TOKEN secret. - PyPI generates PEP 740 attestations for the uploaded files automatically, so releases are signed and show verified provenance on pypi.org. - release-doctor no longer requires the token secret; bin/check-release-environment drops the check. - bin/publish-pypi stays as a manual, token-based escape hatch. - pyproject.toml adds Documentation and Changelog project URLs. The 'groq' project on PyPI must have a Trusted Publisher configured for this repository and workflow BEFORE this change merges, or the next release will fail to publish.
pmichalina-groq
requested review from
andrewtlw and
cwilmott-groq
as code owners
August 10, 2026 20:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of GC1-104.
What
Replace token-based PyPI publishing with Trusted Publishing (GitHub OIDC):
publish-pypiworkflow now builds with rye and uploads withpypa/gh-action-pypi-publish(pinned to the v1.14.2 commit). The job getsid-token: writeand no longer readsPYPI_TOKEN/GROQ_PYPI_TOKEN.release-doctorandbin/check-release-environmentno longer require the token secret.bin/publish-pypistays unchanged as a manual, token-based escape hatch (see CONTRIBUTING.md).pyproject.tomlgainsDocumentationandChangelogproject URLs. With Trusted Publishing active, PyPI also marks the GitHub URLs as verified.DO NOT MERGE until PyPI is configured
The
groqproject on PyPI must have a Trusted Publisher configured before this merges, or the next release will fail to publish. An owner of https://pypi.org/project/groq/ must:groqgroq-pythonpublish-pypi.ymlGROQ_PYPI_TOKEN/PYPI_TOKENGitHub secrets and revoke the PyPI API token.Verification
rye build --cleansucceeds; sdist PKG-INFO shows the new project URLs andAuthor-email: Groq <[email protected]>uvx yamllinton both workflows: no errors (only pre-existing line-length warnings)bash -n bin/check-release-environmentpassesNote on Stainless
These workflow files are Stainless-generated templates. If a future codegen run conflicts with this change, the publishing config should be moved into the Stainless project config so the generator emits the OIDC workflow.
Companion PR: #280 updates the dependency lock files. The two PRs are independent; that one can merge first.