Automated PyPI releases

[itamarst]

Specifically, consider setting up https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/ and then anyone who can tag a release can trigger an upload to PyPI.

[meejah]

I have looked at those (including OIDC) a little bit before but not sure I can claim to fully understand it ;)

To make sure I understand:
this would mean a compromised GitHub (well, "Actions" infrastructure) would be able to publish to PyPI, correct? But a threat-actor gaining temporary partial access and e.g. grabbing a foolscap ephemeral publishing token does not get to publish releases later (because of the time-limits etc).

So, this is better than burning release-keys / credentials into a cloud-based workflow .. but still does put trust in github infrastructure generally.

Are there additional advantages (or disadvantages) I'm missing?

[sajith]

@meejah I have configured another unrelated project with a "trusted publisher" workflow. As for advantages, PyPI docs claims what you stated, and the usability gain from not having to manage an API token.

https://docs.pypi.org/trusted-publishers/

Not sure about disadvantages, other than trusting the parties involved in publishing and that this has all been done correctly. We'd be trusting them anyway when publishing packages from a GitHub Actions workflow.

[meejah]

Currently, the workflow is "build on a developer machine" I believe..?

(I can understand how this is better than putting longer-term credentials into GHA, wanted to make sure I didn't miss something else)

[sajith]

I'm not familiar with the process, but I don't think there's a CI workflow to publish foolscap packages on PyPI, unless it is well-hidden. :-)

I guess (not 100% sure) another advantage of a trusted publisher would be that PRs from a fork also can publish packages, for example in TestPyPI, as part of a CI workflow. The workflow will need id-token: write permission.

https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token

The "publish to TestPyPI" CI step in zfec failed when Itamar made some PRs, for example. That (in theory?) should not happen once zfec is set up to use a trusted publisher workflow.

https://github.com/tahoe-lafs/zfec/actions/runs/6617382596/job/17973803264