-
Notifications
You must be signed in to change notification settings - Fork 70
feat: Use Trusted Publishers with GitLab CI/CD#411
feat: Use Trusted Publishers with GitLab CI/CD #411matthewfeickert wants to merge 3 commits intoscientific-python:main from
Conversation
@matthewfeickert
matthewfeickert
commented
Apr 17, 2024
- PyPI Trusted Publisher support now includes GitLab CI/CD, so use generated OIDC tokens to publish to TestPyPI or PyPI as needed in GitLab pipelines.
- c.f. https://blog.pypi.org/posts/2024-04-17-expanding-trusted-publisher-support/
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These steps are currently based off of those show in pypi/warehouse#13575 (comment). @kratsg can you please try this PR's changes on one of your CERN GitLab projects to validate them before we request review?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah they're actually in the docs now: https://docs.pypi.org/trusted-publishers/using-a-publisher/#gitlab-cicd and https://docs.pypi.org/trusted-publishers/security-model/#gitlab-cicd
ccc0e99 to
553190e
Compare
553190e to
8a55804
Compare
* PyPI Trusted Publisher support now includes GitLab CI/CD, so use generated OIDC tokens to publish to TestPyPI or PyPI as needed in GitLab pipelines. - c.f. https://blog.pypi.org/posts/2024-04-17-expanding-trusted-publisher-support/
* Requires id v1.4.0+
8a55804 to
14518cf
Compare
facutuesca
commented
May 2, 2025
Since twine 6.1.0, uploading with Trusted Publishing on GitLab CI/CD is automatically detected, and doesn't need any of the manual steps that were needed before (other than adding the id_tokens section). For example:
publish-job:
stage: deploy
image: python:3-bookworm
id_tokens:
PYPI_ID_TOKEN:
aud: pypi
script:
- python -m pip install -U twine
- twine upload python_pkg/dist/*
See the updated docs here: https://docs.pypi.org/trusted-publishers/using-a-publisher/#gitlab-cicd