python/erldistpy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

switch to Trusted Publishing OIDC, drop twine/setuptools pins, v0.1.4

Browse source 
Pending publisher registered on PyPI for python/erldistpy with
workflow filepath .gitlab-ci.yml — GitLab now mints a short-lived
OIDC ID token (audience=pypi) per pipeline, twine 6+ exchanges it
for a scoped upload token. No long-lived secret on the runner.

What this commit changes:
  - .gitlab-ci.yml pypi-twine stage gains id_tokens: PYPI_ID_TOKEN
  - pip install twine (no <6 pin) — twine 6 is OIDC-native
  - pyproject.toml build-system requires drops the setuptools<77 cap
    (latest setuptools emits Metadata-Version 2.4 which twine 6 reads
    fine; locally verified)

After this tag publishes successfully, the same pattern goes to:
  - ago (python/ago)
  - make-post-sell (engineering/make-post-sell)
  - remarkbox (engineering/remarkbox)
each gets a Trusted Publisher entry added on the PyPI project page,
then the id_tokens block lands in their CI.

Recipe lives at docs/PYPI-TRUSTED-PUBLISHING.md (updated to reflect
the new auth model is now live for erldistpy).
This commit is contained in:
russell@unturf.com 2026-06-16 14:54:53 -04:00
parent 08e89d5652
commit 049666b061
No known key found for this signature in database
3 changed files with 10 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

9
pyproject.toml
View file

@ -1,15 +1,10 @@
[build-system]
# setuptools 77+ emits Metadata-Version 2.4 (PEP 639 license-expression).
# twine <6 caps at metadata 2.3 and rejects 2.4 wheels with "Metadata is
# missing required fields: Name, Version." Until we migrate the build
# runner to Trusted Publishing OIDC (which lets us use twine 6+), keep
# setuptools below 77 so the wheel stays metadata 2.3.
requires = ["setuptools>=68,<77", "wheel"]
requires = ["setuptools>=68", "wheel"]
build-backend = "setuptools.build_meta"
[project]
name = "erldistpy"
version = "0.1.3"
version = "0.1.4"
description = "Native Python client for Erlang distribution protocol — EPMD + v6 handshake + gen_server call(), no asyncio."
readme = { file = "README.md", content-type = "text/markdown" }
requires-python = ">=3.10"