From bd033cfaf09ac32924521d89108860f0ea151f1c Mon Sep 17 00:00:00 2001 From: "Qiaoyu (Joey) Deng" Date: Fri, 23 Oct 2026 14:16:07 -0700 Subject: [PATCH] ci(release): upload PEP 740 attestations to PyPI - Publish with `pypa/gh-action-pypi-publish` (v1.14.3, SHA-pinned) in `release.yml` and `nightly.yml`; it signs an attestation for each file with the workflow's OIDC identity, so PyPI shows provenance - `uv publish` uploads only pre-generated attestations, so the publish jobs drop their `setup-uv` step --- .github/workflows/nightly.yml | 11 ++++------- .github/workflows/release.yml | 11 ++++------- 2 files changed, 8 insertions(+), 14 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index ba486260..dc470e47 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -93,18 +93,15 @@ jobs: name: pypi-nightly url: https://pypi.org/p/coreai-opt-nightly permissions: - id-token: write # mint the OIDC token PyPI validates for Trusted Publishing + id-token: write # mint the OIDC token for Trusted Publishing and attestation signing contents: read steps: - - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - with: - enable-cache: false - name: Download wheel uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: nightly-wheel path: dist/ - name: Publish to PyPI - # `always` requires Trusted Publishing (OIDC) — no fallback to tokens. - run: uv publish --trusted-publishing always + # Uploads via Trusted Publishing and signs a PEP 740 attestation for each + # file with this workflow's OIDC identity, so PyPI shows its provenance. + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9edff751..d1af1386 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -137,18 +137,15 @@ jobs: name: pypi url: https://pypi.org/p/coreai-opt permissions: - id-token: write # mint the OIDC token PyPI validates for Trusted Publishing + id-token: write # mint the OIDC token for Trusted Publishing and attestation signing contents: read steps: - - name: Install uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - with: - enable-cache: false - name: Download distributions uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: dist path: dist/ - name: Publish to PyPI - # `always` requires Trusted Publishing (OIDC) — no fallback to tokens. - run: uv publish --trusted-publishing always + # Uploads via Trusted Publishing and signs a PEP 740 attestation for each + # file with this workflow's OIDC identity, so PyPI shows its provenance. + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3