chore(ci): publish to PyPI with Trusted Publishing / OIDC (GC1-104)

.github/workflows/publish-pypi.yml

@@ -1,6 +1,10 @@
 # This workflow is triggered when a GitHub release is created.
 # It can also be run manually to re-publish to PyPI in case it failed for some reason.
 # You can run this workflow by navigating to https://www.github.com/groq/groq-python/actions/workflows/publish-pypi.yml
+#
+# Publishing authenticates with PyPI through Trusted Publishing (GitHub OIDC),
+# so no PyPI API token is required: https://docs.pypi.org/trusted-publishers/
+# PyPI generates PEP 740 attestations for the uploaded files automatically.
 name: Publish PyPI
 on:
   workflow_dispatch:
@@ -12,6 +16,10 @@ jobs:
   publish:
     name: publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # Required to mint the OIDC token for PyPI Trusted Publishing.
+      id-token: write
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -24,8 +32,8 @@ jobs:
           RYE_VERSION: '0.44.0'
           RYE_INSTALL_OPTION: '--yes'
 
+      - name: Build distributions
+        run: rye build --clean
+
       - name: Publish to PyPI
-        run: |
-          bash ./bin/publish-pypi
-        env:
-          PYPI_TOKEN: ${{ secrets.GROQ_PYPI_TOKEN || secrets.PYPI_TOKEN }}
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

.github/workflows/release-doctor.yml

@@ -17,5 +17,3 @@ jobs:
       - name: Check release environment
         run: |
           bash ./bin/check-release-environment
-        env:
-          PYPI_TOKEN: ${{ secrets.GROQ_PYPI_TOKEN || secrets.PYPI_TOKEN }}

CONTRIBUTING.md

@@ -119,7 +119,7 @@ the changes aren't made through the automated pipeline, you may want to make rel
 
 ### Publish with a GitHub workflow
 
-You can release to package managers by using [the `Publish PyPI` GitHub action](https://www.github.com/groq/groq-python/actions/workflows/publish-pypi.yml). This requires a setup organization or repository secret to be set up.
+You can release to package managers by using [the `Publish PyPI` GitHub action](https://www.github.com/groq/groq-python/actions/workflows/publish-pypi.yml). The workflow authenticates with [PyPI Trusted Publishing](https://docs.pypi.org/trusted-publishers/) (GitHub OIDC), so it does not need a PyPI token secret. PyPI generates [PEP 740 attestations](https://docs.pypi.org/attestations/) for the uploaded files automatically.
 
 ### Publish manually
 

bin/check-release-environment

@@ -2,9 +2,9 @@
 
 errors=()
 
-if [ -z "${PYPI_TOKEN}" ]; then
-  errors+=("The PYPI_TOKEN secret has not been set. Please set it in either this repository's secrets or your organization secrets.")
-fi
+# PyPI publishing authenticates with Trusted Publishing (GitHub OIDC) in the
+# publish-pypi workflow, so no PyPI token is required in the release
+# environment. See https://docs.pypi.org/trusted-publishers/
 
 lenErrors=${#errors[@]}
 

pyproject.toml

@@ -38,6 +38,8 @@ classifiers = [
 [project.urls]
 Homepage = "https://github.com/groq/groq-python"
 Repository = "https://github.com/groq/groq-python"
+Documentation = "https://console.groq.com/docs"
+Changelog = "https://github.com/groq/groq-python/blob/main/CHANGELOG.md"
 
 [project.optional-dependencies]
 aiohttp = ["aiohttp", "httpx_aiohttp>=0.1.9"]