ci: align PyPI publish workflow with trusted publishing#7
Conversation
- Rename publish.yml -> pypi-release.yml to match the PyPI trusted publisher config (OIDC matches on the exact workflow filename). - Drop the API-token password from the publish step so the action uses Trusted Publishing (OIDC) via the existing id-token permission. - Remove the unused packages: write permission (not needed for PyPI).
📝 WalkthroughWalkthroughThe PyPI release workflow migrates from API token authentication to OIDC trusted publishing. The ChangesPyPI Trusted Publishing Migration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pypi-release.yml:
- Around line 52-53: The Publish step uses a branch reference (`@release/v1`) for
the pypa/gh-action-pypi-publish action, which poses a supply chain security risk
since the workflow has id-token: write permissions. Replace the branch reference
with a pinned commit SHA hash to ensure the exact version of the action is
always used and prevent upstream compromise.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 19fb72ad-c61b-4cfd-8f54-71064893f409
📒 Files selected for processing (1)
.github/workflows/pypi-release.yml
| - name: Publish | ||
| uses: pypa/gh-action-pypi-publish@v1 | ||
| with: | ||
| password: ${{ secrets.PYPI_API_TOKEN }} | ||
| uses: pypa/gh-action-pypi-publish@release/v1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Get the current commit SHA for the release/v1 branch of pypa/gh-action-pypi-publish
gh api repos/pypa/gh-action-pypi-publish/git/ref/heads/release/v1 --jq '.object.sha'Repository: dsih-artpark/patchsim
Length of output: 106
Pin action to a SHA hash for supply chain security.
The pypa/gh-action-pypi-publish action uses a branch reference (@release/v1) instead of a pinned SHA hash. For workflows with id-token: write permissions that publish packages, pinning to a commit SHA provides protection against upstream compromise.
🔒 Suggested fix
- name: Publish
- uses: pypa/gh-action-pypi-publish@release/v1
+ uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Publish | |
| uses: pypa/gh-action-pypi-publish@v1 | |
| with: | |
| password: ${{ secrets.PYPI_API_TOKEN }} | |
| uses: pypa/gh-action-pypi-publish@release/v1 | |
| - name: Publish | |
| uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 53-53: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pypi-release.yml around lines 52 - 53, The Publish step
uses a branch reference (`@release/v1`) for the pypa/gh-action-pypi-publish
action, which poses a supply chain security risk since the workflow has
id-token: write permissions. Replace the branch reference with a pinned commit
SHA hash to ensure the exact version of the action is always used and prevent
upstream compromise.
Source: Linters/SAST tools
1 participant
Why
The PyPI trusted publisher for
patchsimwas just configured (ownerdsih-artpark, repopatchsim, workflowpypi-release.yml, environmentpypi). Two things in the repo prevented a release from actually publishing:publish.yml, but the trusted publisher matches on the exact filenamepypi-release.yml. OIDC auth would have failed.password: ${{ secrets.PYPI_API_TOKEN }}, but no such secret exists (no repo orpypi-env secrets). With trusted publishing we must omit the password so the action uses OIDC.Changes
.github/workflows/publish.yml→.github/workflows/pypi-release.yml.password:from the publish step → action uses Trusted Publishing (OIDC) via the existingid-token: writepermission.packages: writepermission (not needed for PyPI).After merge
Cut the first release by publishing a GitHub Release with tag
v0.1.0b1(version is already set inpyproject.toml). Therelease: publishedevent fires the workflow, which builds, tests, and publishes to PyPI via OIDC.Note:
0.1.0b1is a pre-release, so installs needpip install --pre patchsim(orpatchsim==0.1.0b1).Summary by CodeRabbit