From 67f2c3b575c9a8541461dea994873f4e77c8e6f9 Mon Sep 17 00:00:00 2001 From: Umutcan Edizsalan Date: Thu, 23 Jul 2026 15:37:17 +0300 Subject: [PATCH] ci(release): publish to PyPI with the PYPI_API_TOKEN secret instead of OIDC trusted publishing Co-authored-by: Cursor --- .github/workflows/release.yml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 851af91..877c48b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,12 +1,13 @@ name: Release -# Tag-driven release: run the test gate, build, publish to PyPI via trusted -# publishing (OIDC — no API token stored in the repo), then cut the GitHub -# Release with the built artifacts attached. +# Tag-driven release: run the test gate, build, publish to PyPI, then cut the +# GitHub Release with the built artifacts attached. # -# One-time setup on PyPI (manual): project "autocad-mcp-pro" -> Publishing -> -# add GitHub publisher repo=U-C4N/Autocad-MCP workflow=release.yml -# environment=pypi. +# Auth: the PYPI_API_TOKEN repository secret (an API token from +# https://pypi.org/manage/account/token/). Once the project exists on PyPI, +# prefer replacing it with a project-scoped token — or switch back to trusted +# publishing (OIDC) by restoring `environment: pypi` + `id-token: write` and +# registering the publisher on PyPI. on: push: @@ -57,16 +58,15 @@ jobs: publish-pypi: needs: build runs-on: ubuntu-latest - environment: pypi - permissions: - id-token: write steps: - uses: actions/download-artifact@v4 with: name: dist path: dist/ - - name: Publish to PyPI (trusted publishing) + - name: Publish to PyPI uses: pypa/gh-action-pypi-publish@release/v1 + with: + password: ${{ secrets.PYPI_API_TOKEN }} github-release: needs: publish-pypi