Upload to PyPI using trusted publishing (#4482)

Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>
codalab · Jul 26, 2023 · 3e1d9fa · 3e1d9fa
1 parent 2992b37
commit 3e1d9fa
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 20 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ jobs:
   release_to_pypi:
     name: Release to PyPi
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-python@v4
@@ -26,5 +28,6 @@ jobs:
           TAG: ${{ github.event.release.tag_name }}
           CODALAB_DOCKER_USERNAME: ${{ secrets.CODALAB_DOCKER_USERNAME }}
           CODALAB_DOCKER_PASSWORD: ${{ secrets.CODALAB_DOCKER_PASSWORD }}
-          TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }}
+      # Uses trusted publishing to authenticate to PyPI: see https://docs.pypi.org/trusted-publishers/using-a-publisher/
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
diff --git a/scripts/ci-deploy.sh b/scripts/ci-deploy.sh
@@ -18,5 +18,5 @@ PUSH_FLAG=$([ -z "${CODALAB_DOCKER_USERNAME}" ] || echo "--push")
 python3 codalab_service.py build --version v$tag --pull $PUSH_FLAG
 if [ "$tag" != "master" ]; then
   python3 codalab_service.py build --version latest --pull $PUSH_FLAG
-  ./scripts/upload-to-pypi.sh $tag
+  python3 setup.py bdist_wheel sdist
 fi
diff --git a/scripts/upload-to-pypi.sh b/scripts/upload-to-pypi.sh