Configure workflows for PyPI Trusted Publishing (OIDC)

Author: yeldarby

.github/workflows/publish-release.yml

@@ -1,18 +1,27 @@
 name: Publish rffickle to PyPI
 
 on:
-  release:
-    types: [created]
+  push:
+    tags:
+      - "v*"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   publish:
+    name: Publish to PyPI
     runs-on: ubuntu-latest
+    environment:
+      name: release
+      url: https://pypi.org/project/rffickle/
+    permissions:
+      id-token: write  # Required for OIDC/Trusted Publishing
+      contents: read
     steps:
       - name: 🛎️ Checkout
         uses: actions/checkout@v4
-        with:
-          ref: ${{ github.head_ref }}
 
       - name: 🐍 Set up Python
         uses: actions/setup-python@v5
@@ -30,8 +39,6 @@ jobs:
           twine check dist/*
           
       - name: 🚀 Publish to PyPI
-        env:
-          PYPI_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-        run: |
-          twine upload dist/* -u $PYPI_USERNAME -p $PYPI_PASSWORD --verbose
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true

.github/workflows/publish-testpypi.yml

@@ -8,9 +8,19 @@ on:
       - 'setup.py'
       - 'src/**'
 
+permissions:
+  contents: read
+
 jobs:
   publish-test:
+    name: Publish to TestPyPI
     runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/project/rffickle/
+    permissions:
+      id-token: write  # Required for OIDC/Trusted Publishing
+      contents: read
     steps:
       - name: 🛎️ Checkout
         uses: actions/checkout@v4
@@ -31,7 +41,7 @@ jobs:
           twine check dist/*
           
       - name: 🚀 Publish to TestPyPI
-        env:
-          PYPI_TEST_PASSWORD: ${{ secrets.PYPI_TEST_PASSWORD }}
-        run: |
-          twine upload --repository testpypi dist/* -u __token__ -p $PYPI_TEST_PASSWORD --verbose
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+          attestations: true