CI: add PyPI Trusted-Publishing “publish” job to wheels workflow (#61669) #61718
Conversation
|
CI failed in the docstring-validation step with This occurs before my code runs, so it isn’t caused by the changes in this PR. |
|
This workflow runs every day, on all pushes, and on all pull requests, but you said "uploads to PyPI when a release tag is pushed" in the description. Perhaps you want to put this in a new Because this makes the You could alternatively add You need to update the release process documentation to change the new method for publishing (remove step 5: "Upload wheels to PyPI"). You likely want to document (in this pull request's description, and in the release process documentation) the new |
simonjayhawkins
added
Enhancement
Build
evgmosme
force-pushed
the
trusted-publish-pypi
branch
from
d6552ce to
58cb179
Compare
evgmosme
force-pushed
the
trusted-publish-pypi
branch
from
6232f6f to
7359e1b
Compare
|
@EpicWink All requested changes are in. Let me know if anything else’s needed - thanks! |
There was a problem hiding this comment.
You likely want to document (in this pull request's description, and in the release process documentation) the new pypi GitHub environment needs to exist, and the corresponding publisher needs to be added to the project in PyPI.
Still want to do this, at least in this pull request's description
| publish: | ||
| if: > | ||
| github.repository == 'pandas-dev/pandas' && | ||
| github.event_name == 'push' && |
There was a problem hiding this comment.
| github.event_name == 'push' && | |
| github.event_name == 'release' && |
To match documentation
|
|
||
| twine upload pandas/dist/pandas-<version>*.{whl,tar.gz} --skip-existing | ||
| 5. Wheels are uploaded automatically by GitHub Actions | ||
| via **Trusted Publishing** when the GitHub *Release* |
There was a problem hiding this comment.
| via **Trusted Publishing** when the GitHub *Release* | |
| via [**Trusted Publishing**](https://docs.pypi.org/trusted-publishers/) | |
| when the GitHub [*Release*](https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases) |
Link to documentation
| twine upload pandas/dist/pandas-<version>*.{whl,tar.gz} --skip-existing | ||
| 5. Wheels are uploaded automatically by GitHub Actions | ||
| via **Trusted Publishing** when the GitHub *Release* | ||
| is published. No manual ``twine upload`` step is required. |
There was a problem hiding this comment.
| is published. No manual ``twine upload`` step is required. | |
| is published. Do not run ``twine upload`` manually. |
Your language makes it sounds like it's optional to run twine upload, but we actually don't want this (but perhaps you can instead say that twine upload is only for exceptional circumstances).
| 5. Upload wheels to PyPI:: | ||
|
|
||
| twine upload pandas/dist/pandas-<version>*.{whl,tar.gz} --skip-existing | ||
| 5. Wheels are uploaded automatically by GitHub Actions |
There was a problem hiding this comment.
| 5. Wheels are uploaded automatically by GitHub Actions | |
| 5. Verify wheels are uploaded automatically by GitHub Actions |
Actually make step 5 an action
pre-commit& CI)doc/source/whatsnew/v3.0.0.rstSummary
This PR enables Trusted Publishing (OIDC) uploads to PyPI when a GitHub release is published.
What’s changed
.github/workflows/wheels.yml
publishjob that*pyodide*.whl);pypa/gh-action-pypi-publish@v1in thepypienvironment.doc/source/whatsnew/v3.0.0.rst
doc/source/development/maintaining.rst
No other files or CI matrix settings were changed.