diff --git a/.github/actions/publish-pypi/action.yaml b/.github/actions/publish-pypi/action.yaml deleted file mode 100644 index d4fd64fe5..000000000 --- a/.github/actions/publish-pypi/action.yaml +++ /dev/null @@ -1,69 +0,0 @@ ---- -name: Publish to PyPI via Trusted Publishing -description: > - Download a build artifact, verify its provenance attestations, and upload to - PyPI using OIDC-based Trusted Publishing (no long-lived API token). - -# This composite action is a workaround for pypi/warehouse#11096: PyPI's -# Trusted Publisher config matches the OIDC `job_workflow_ref` claim against -# the *caller's* workflow file, but reusable workflows mint a token whose -# `job_workflow_ref` names the reusable workflow. Composite actions inherit -# the calling job's OIDC context, so invoking this action from a downstream -# caller's `release.yaml` keeps `job_workflow_ref` pointing at that file — -# which is what the downstream's PyPI Trusted Publisher must register. - -inputs: - artifact-name: - description: Name of the dist artifact uploaded by the upstream build job. - required: true - attestation-signer-repo: - description: > - Repository that signed the build attestations, passed to - `gh attestation verify --signer-repo`. - required: false - default: kdeldycke/repomatic - repository-url: - description: > - Optional override for the PyPI repository URL (e.g., TestPyPI). Leave - empty to publish to the canonical PyPI index. - required: false - default: "" - -runs: - using: composite - steps: - - uses: astral-sh/setup-uv@6ee6290f1cbc4156c0bdd66691b2c144ef8df19a # v7.4.0 - with: - enable-cache: false - - - name: Download build artifact - id: download - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 - with: - name: ${{ inputs.artifact-name }} - - - name: Verify build attestations - env: - GH_TOKEN: ${{ github.token }} - DOWNLOAD_PATH: ${{ steps.download.outputs.download-path }} - SIGNER_REPO: ${{ inputs.attestation-signer-repo }} - shell: bash - run: | - for f in "${DOWNLOAD_PATH}"/*; do - echo "Verifying: ${f}" - gh attestation verify "${f}" \ - --repo "${GITHUB_REPOSITORY}" \ - --signer-repo "${SIGNER_REPO}" - done - - - name: Push to PyPI - env: - DOWNLOAD_PATH: ${{ steps.download.outputs.download-path }} - REPOSITORY_URL: ${{ inputs.repository-url }} - shell: bash - run: | - args=(--no-progress publish --trusted-publishing automatic) - if [[ -n "${REPOSITORY_URL}" ]]; then - args+=(--publish-url "${REPOSITORY_URL}") - fi - uv "${args[@]}" "${DOWNLOAD_PATH}"/*