feat: add PyPI publish workflow (OIDC trusted publishing) - #260
Draft
Brian Krabach (bkrabach) wants to merge 1 commit into
Draft
feat: add PyPI publish workflow (OIDC trusted publishing)#260Brian Krabach (bkrabach) wants to merge 1 commit into
Brian Krabach (bkrabach) wants to merge 1 commit into
Conversation
Adds OIDC trusted publishing to PyPI via a tag-triggered workflow, mirroring the pattern established in amplifier-core (push tags v* + workflow_dispatch, pypa/gh-action-pypi-publish, id-token:write). Changes: - .github/workflows/publish.yml: single ubuntu-latest job, uv build (sdist + py3-none-any wheel), OIDC publish on v* tags. Includes tag-vs-pyproject version verification gate. - RELEASING.md: full release procedure (bump version → merge → push tag), one-time PyPI trusted publisher setup checklist (pending publisher for amplifier-foundation, pypi GitHub environment), and pre-release naming. One-time action required before first publish: Configure PyPI pending trusted publisher for project amplifier-foundation, repo microsoft/amplifier-foundation, workflow publish.yml, env pypi. Create the pypi GitHub Actions environment in repo settings. The OIDC handshake is only provable via a real tag-triggered CI run. 🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier) Co-Authored-By: Amplifier <240397093+microsoft-amplifier@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a tag-driven GitHub Actions workflow for building and publishing the pure-Python sdist+wheel to PyPI via OIDC trusted publishing. Mirrors amplifier-core's proven pattern: push a
v*git tag, CI builds and publishes automatically with no tokens in-repo.Also adds
RELEASING.mdwith version/tag conventions and publishing steps.What this does
publish.yml: GitHub Actions workflow that triggers on
v*tagsRELEASING.md: Documents version/tag conventions and the publish flow for future maintainers
Before this can publish
PyPI side setup (one-time):
amplifier-foundationmicrosoftamplifier-foundationpublish.ymlpypipypienvironment in the GitHub repo (Settings → Environments)Tagging and publishing:
vX.Y.Z&& git push --tagsValidation
Locally validated via
uv build:Note: The OIDC handshake itself (confirming the trusted publisher works) can only be validated by the first real tagged run after the trusted publisher is set up at PyPI.