python-lib

python-lib copied to clipboard

Fix security issues with the Trusted Publishing example

11

https://github.com/simonw/python-lib/blob/4b825ed/%7B%7Bcookiecutter.hyphenated%7D%7D/.github/workflows/publish.yml#L44-L49 suggests that building the dists within the same job that publishes them is okay. But it's not. Such a structure opens the workflow users to privilege escalation through poisoning...

webknjaz