Update build.yml

forced to adopt trusted publishing
cvxgrp · Aug 23, 2023 · 927aa4f · 927aa4f
1 parent 806a28a
commit 927aa4f
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -7,6 +7,9 @@ jobs:
     deploy-pypi:
         runs-on: ubuntu-latest
         environment: deployment
+        permissions:
+          id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
         steps:
           - name: Checkout Repository
             uses: actions/checkout@v3
@@ -24,8 +27,8 @@ jobs:
               git fetch --prune --unshallow --tags
               sudo python setup.py sdist bdist_wheel
 
-          - name: Push to PyPI
-            run: sudo twine upload -u ${{ secrets.PYPI_USERNAME }} -p ${{ secrets.PYPI_PASSWORD }} dist/*
+          - name: Publish package distributions to PyPI
+            uses: pypa/gh-action-pypi-publish@release/v1
 
     deploy-conda:
         runs-on: ubuntu-latest