From 714f52180dcffb4e7324923c09ff995718549203 Mon Sep 17 00:00:00 2001 From: ulises-jeremias Date: Thu, 16 Jul 2026 03:20:51 -0300 Subject: [PATCH] ci: PyPI Trusted Publishing OIDC job Closes #58 Co-authored-by: Cursor --- .github/workflows/publish.yml | 4 +++- docs/DISTRIBUTION_SETUP.md | 7 +++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 63b25f3..11919f1 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -32,4 +32,6 @@ jobs: files: dist/* - name: Publish to PyPI (OIDC) if: startsWith(github.ref, 'refs/tags/') - run: echo "PyPI trusted publishing wired in #58 — placeholder job" + uses: pypa/gh-action-pypi-publish@release/v1 + with: + packages-dir: dist/ diff --git a/docs/DISTRIBUTION_SETUP.md b/docs/DISTRIBUTION_SETUP.md index 7bcdfe3..9ff8125 100644 --- a/docs/DISTRIBUTION_SETUP.md +++ b/docs/DISTRIBUTION_SETUP.md @@ -8,3 +8,10 @@ Secrets and publishers (see also #58–#63): | Docker Hub | `DOCKERHUB_USERNAME`, `DOCKERHUB_TOKEN` | | AUR | `AUR_SSH_PRIVATE_KEY`, `AUR_REPO_TOKEN` | | Homebrew | `HOMEBREW_TAP_TOKEN` | + +## PyPI Trusted Publishing + +1. Create a Trusted Publisher on PyPI for `create-awesome-python-app` +2. Repository: `Create-Python-App/create-python-app` +3. Workflow: `publish.yml` +4. No `PYPI_TOKEN` secret required when using OIDC