|
| 1 | +# PyPI Publishing Setup |
| 2 | + |
| 3 | +## Option 1: Trusted Publishing (Recommended) |
| 4 | + |
| 5 | +### Steps to Configure Trusted Publishing on PyPI: |
| 6 | + |
| 7 | +1. **Go to PyPI Project Settings:** |
| 8 | + - Visit https://pypi.org/manage/project/nexus-fs-python/settings/publishing/ |
| 9 | + - Or navigate: PyPI → Your Account → Manage → nexus-fs-python → Publishing |
| 10 | + |
| 11 | +2. **Add Trusted Publisher:** |
| 12 | + - Click "Add a new trusted publisher" |
| 13 | + - Select "GitHub Actions" as publisher type |
| 14 | + - Fill in: |
| 15 | + - **Owner:** `nexi-lab` |
| 16 | + - **Repository:** `nexus-python` |
| 17 | + - **Workflow filename:** `.github/workflows/release.yml` |
| 18 | + - **Environment:** (leave empty, or create a `pypi` environment in GitHub for extra security) |
| 19 | + - Click "Add" |
| 20 | + |
| 21 | +3. **Update Workflow (if using environment):** |
| 22 | + - If you created a `pypi` environment in GitHub, update the workflow to use it: |
| 23 | + ```yaml |
| 24 | + jobs: |
| 25 | + build-and-publish: |
| 26 | + runs-on: ubuntu-latest |
| 27 | + environment: pypi # Add this line |
| 28 | + ``` |
| 29 | +
|
| 30 | +4. **Re-run the workflow:** |
| 31 | + - The workflow will now use OIDC authentication automatically |
| 32 | + - No API token needed! |
| 33 | +
|
| 34 | +## Option 2: Use API Token (Fallback) |
| 35 | +
|
| 36 | +If you prefer to use an API token instead: |
| 37 | +
|
| 38 | +1. **Create PyPI API Token:** |
| 39 | + - Go to https://pypi.org/manage/account/token/ |
| 40 | + - Click "Add API token" |
| 41 | + - Name: `nexus-python-release` |
| 42 | + - Scope: "Entire account" or project-specific |
| 43 | + - Copy the token (starts with `pypi-`) |
| 44 | + |
| 45 | +2. **Add to GitHub Secrets:** |
| 46 | + - Go to: https://github.com/nexi-lab/nexus-python/settings/secrets/actions |
| 47 | + - Click "New repository secret" |
| 48 | + - Name: `PYPI_API_TOKEN` |
| 49 | + - Value: Your token (e.g., `pypi-AgEIcHJ...`) |
| 50 | + - Click "Add secret" |
| 51 | + |
| 52 | +3. **Update Workflow:** |
| 53 | + - The workflow already has `password: ${{ secrets.PYPI_API_TOKEN }}` |
| 54 | + - But we need to explicitly disable trusted publishing: |
| 55 | + ```yaml |
| 56 | + - name: Publish to PyPI |
| 57 | + uses: pypa/gh-action-pypi-publish@release/v1 |
| 58 | + with: |
| 59 | + password: ${{ secrets.PYPI_API_TOKEN }} |
| 60 | + # Explicitly disable trusted publishing |
| 61 | + trusted-publisher: false |
| 62 | + ``` |
| 63 | + |
| 64 | +## Current Workflow Configuration |
| 65 | + |
| 66 | +The workflow is currently configured to: |
| 67 | +- Use trusted publishing (OIDC) if available |
| 68 | +- Fall back to `PYPI_API_TOKEN` if provided |
| 69 | + |
| 70 | +The error indicates trusted publishing is not configured, so you need to either: |
| 71 | +1. Set up trusted publishing on PyPI (Option 1 - recommended) |
| 72 | +2. Or ensure `PYPI_API_TOKEN` secret exists and modify workflow to explicitly use it |
0 commit comments