CI: add PyPI Trusted-Publishing “publish” job to wheels workflow (#61669) #61718
+46
−3
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -13,6 +13,8 @@ | |
| name: Wheel builder | ||
|
|
||
| on: | ||
| release: | ||
| types: [published] | ||
| schedule: | ||
| # 3:27 UTC every day | ||
| - cron: "27 3 * * *" | ||
|
|
@@ -219,3 +221,42 @@ jobs: | |
| source ci/upload_wheels.sh | ||
| set_upload_vars | ||
| upload_wheels | ||
| publish: | ||
| if: > | ||
| github.repository == 'pandas-dev/pandas' && | ||
| github.event_name == 'release' && | ||
| startsWith(github.ref, 'refs/tags/v') | ||
| needs: | ||
| - build_sdist | ||
| - build_wheels | ||
|
|
||
| runs-on: ubuntu-latest | ||
|
|
||
| environment: | ||
| name: pypi | ||
| permissions: | ||
| id-token: write # OIDC for Trusted Publishing | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Download all artefacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| path: dist # everything lands in ./dist/** | ||
|
|
||
| - name: Collect files | ||
| run: | | ||
| mkdir -p upload | ||
| # skip any wheel that contains 'pyodide' | ||
| find dist -name '*pyodide*.whl' -prune -o \ | ||
| -name '*.whl' -exec mv {} upload/ \; | ||
| find dist -name '*.tar.gz' -exec mv {} upload/ \; | ||
| - name: Publish to **PyPI** (Trusted Publishing) | ||
| uses: pypa/gh-action-pypi-publish@release/v1 | ||
| with: | ||
| repository-url: https://upload.pypi.org/legacy/ | ||
|
There was a problem hiding this comment. Is this line needed? (it's not included in the example in https://docs.pypi.org/trusted-publishers/using-a-publisher/) There was a problem hiding this comment. It's not necessary, and as far as I know there's no recommendation to hard-code it. When the upload API 2.0 PEP lands, in site this URL and action will change anyway. |
||
| packages-dir: upload | ||
EvMossan marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| skip-existing: true | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -91,6 +91,7 @@ Other enhancements | |
| - Support passing a :class:`Iterable[Hashable]` input to :meth:`DataFrame.drop_duplicates` (:issue:`59237`) | ||
| - Support reading Stata 102-format (Stata 1) dta files (:issue:`58978`) | ||
| - Support reading Stata 110-format (Stata 7) dta files (:issue:`47176`) | ||
| - Switched wheel upload to **PyPI Trusted Publishing** (OIDC) for release-tag pushes in ``wheels.yml``. (:issue:`61718`) | ||
|
|
||
| .. --------------------------------------------------------------------------- | ||
| .. _whatsnew_300.notable_bug_fixes: | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@EpicWink you suggested to add this, but I am wondering if that is needed? As I understand, this wheels.yml workflow will run on the commit pushed to main with a tag, and so that way it will already run for a release? And we can then upload the wheels from that run?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A GitHub release publish happens after a push, allowing you to review the CI, and write release notes in the GitHub release, before triggering the publish to PyPI. Up to you how you want the release workflow to be, if you want to publish unconditionally.