Goal
Publish contractplane without storing a long-lived registry token.
Current state
- GitHub prerelease
v0.1.0a1 is published with wheel and sdist.
- A fresh install from the GitHub tag succeeds.
- PyPI project
contractplane does not exist yet.
- The available local
UV_PUBLISH_TOKEN is scoped to another project and correctly receives HTTP 403 for contractplane.
One-time PyPI setup
Create a Pending Trusted Publisher for:
- owner:
Q00
- repository:
contractplane
- workflow:
release.yml
- environment:
pypi (recommended)
Then add an OIDC publish job to .github/workflows/release.yml with only id-token: write, an environment gate, version/tag/test checks, and uv publish --trusted-publishing always. Keep the existing SHA-pinned Actions and never add a PyPI token secret.
Backfill
Build from tag v0.1.0a1, verify artifact hashes against the GitHub release, publish the same wheel/sdist to PyPI, and confirm a fresh pip install contractplane==0.1.0a1.
Goal
Publish
contractplanewithout storing a long-lived registry token.Current state
v0.1.0a1is published with wheel and sdist.contractplanedoes not exist yet.UV_PUBLISH_TOKENis scoped to another project and correctly receives HTTP 403 forcontractplane.One-time PyPI setup
Create a Pending Trusted Publisher for:
Q00contractplanerelease.ymlpypi(recommended)Then add an OIDC publish job to
.github/workflows/release.ymlwith onlyid-token: write, an environment gate, version/tag/test checks, anduv publish --trusted-publishing always. Keep the existing SHA-pinned Actions and never add a PyPI token secret.Backfill
Build from tag
v0.1.0a1, verify artifact hashes against the GitHub release, publish the same wheel/sdist to PyPI, and confirm a freshpip install contractplane==0.1.0a1.