From afd42dc595362877563690f583cb0977827677aa Mon Sep 17 00:00:00 2001 From: Patrick Michalina Date: Mon, 10 Aug 2026 15:40:24 -0500 Subject: [PATCH] chore(ci): publish to PyPI with Trusted Publishing (OIDC) Replace token-based publishing with PyPI Trusted Publishing: - publish-pypi workflow builds with rye, then uploads with pypa/gh-action-pypi-publish (pinned to v1.14.2). The job gets id-token: write and no longer reads a PYPI_TOKEN secret. - PyPI generates PEP 740 attestations for the uploaded files automatically, so releases are signed and show verified provenance on pypi.org. - release-doctor no longer requires the token secret; bin/check-release-environment drops the check. - bin/publish-pypi stays as a manual, token-based escape hatch. - pyproject.toml adds Documentation and Changelog project URLs. The 'groq' project on PyPI must have a Trusted Publisher configured for this repository and workflow BEFORE this change merges, or the next release will fail to publish. --- .github/workflows/publish-pypi.yml | 16 ++++++++++++---- .github/workflows/release-doctor.yml | 2 -- CONTRIBUTING.md | 2 +- bin/check-release-environment | 6 +++--- pyproject.toml | 2 ++ 5 files changed, 18 insertions(+), 10 deletions(-) diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index 11ce1bbb..3fcdd3d7 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -1,6 +1,10 @@ # This workflow is triggered when a GitHub release is created. # It can also be run manually to re-publish to PyPI in case it failed for some reason. # You can run this workflow by navigating to https://www.github.com/groq/groq-python/actions/workflows/publish-pypi.yml +# +# Publishing authenticates with PyPI through Trusted Publishing (GitHub OIDC), +# so no PyPI API token is required: https://docs.pypi.org/trusted-publishers/ +# PyPI generates PEP 740 attestations for the uploaded files automatically. name: Publish PyPI on: workflow_dispatch: @@ -12,6 +16,10 @@ jobs: publish: name: publish runs-on: ubuntu-latest + permissions: + contents: read + # Required to mint the OIDC token for PyPI Trusted Publishing. + id-token: write steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -24,8 +32,8 @@ jobs: RYE_VERSION: '0.44.0' RYE_INSTALL_OPTION: '--yes' + - name: Build distributions + run: rye build --clean + - name: Publish to PyPI - run: | - bash ./bin/publish-pypi - env: - PYPI_TOKEN: ${{ secrets.GROQ_PYPI_TOKEN || secrets.PYPI_TOKEN }} + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 diff --git a/.github/workflows/release-doctor.yml b/.github/workflows/release-doctor.yml index 8e545f91..c66aea6c 100644 --- a/.github/workflows/release-doctor.yml +++ b/.github/workflows/release-doctor.yml @@ -17,5 +17,3 @@ jobs: - name: Check release environment run: | bash ./bin/check-release-environment - env: - PYPI_TOKEN: ${{ secrets.GROQ_PYPI_TOKEN || secrets.PYPI_TOKEN }} diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bed16c44..5c72d963 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -119,7 +119,7 @@ the changes aren't made through the automated pipeline, you may want to make rel ### Publish with a GitHub workflow -You can release to package managers by using [the `Publish PyPI` GitHub action](https://www.github.com/groq/groq-python/actions/workflows/publish-pypi.yml). This requires a setup organization or repository secret to be set up. +You can release to package managers by using [the `Publish PyPI` GitHub action](https://www.github.com/groq/groq-python/actions/workflows/publish-pypi.yml). The workflow authenticates with [PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/) (GitHub OIDC), so it does not need a PyPI token secret. PyPI generates [PEP 740 attestations](https://docs.pypi.org/attestations/) for the uploaded files automatically. ### Publish manually diff --git a/bin/check-release-environment b/bin/check-release-environment index b845b0f4..98652f1f 100644 --- a/bin/check-release-environment +++ b/bin/check-release-environment @@ -2,9 +2,9 @@ errors=() -if [ -z "${PYPI_TOKEN}" ]; then - errors+=("The PYPI_TOKEN secret has not been set. Please set it in either this repository's secrets or your organization secrets.") -fi +# PyPI publishing authenticates with Trusted Publishing (GitHub OIDC) in the +# publish-pypi workflow, so no PyPI token is required in the release +# environment. See https://docs.pypi.org/trusted-publishers/ lenErrors=${#errors[@]} diff --git a/pyproject.toml b/pyproject.toml index 54e156d0..c86c574d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -38,6 +38,8 @@ classifiers = [ [project.urls] Homepage = "https://github.com/groq/groq-python" Repository = "https://github.com/groq/groq-python" +Documentation = "https://console.groq.com/docs" +Changelog = "https://github.com/groq/groq-python/blob/main/CHANGELOG.md" [project.optional-dependencies] aiohttp = ["aiohttp", "httpx_aiohttp>=0.1.9"]