Use trusted publisher in workflow

Open malwarefrank opened this issue 2 years ago • 2 comments

GitHub action recommends using a Trusted Publisher instead of API tokens in workflows to push to pypi. And the pypi documentation strongly recommends using a GitHub environment.

https://docs.pypi.org/trusted-publishers/using-a-publisher/

Sep 06 '23 03:09 malwarefrank

we enabled this for capa in this PR: https://github.com/mandiant/capa/pull/1613/files

ultimately it was about as easy as the blog post said, which is amazing.

Sep 06 '23 05:09 williballenthin

thanks for the heads-up. Made the changes in b837ad6 and just need to test

Sep 09 '23 02:09 malwarefrank

looks like it's working

Oct 12 '24 02:10 malwarefrank