ci(sdk): publish the Python SDK to PyPI via trusted publishing - #1087
Merged
Conversation
rmyndharis-openwa reached PyPI once, manually, and has sat at 0.1.0 since. Add a tag-triggered workflow matching js-sdk-release.yml. Authentication is PyPI Trusted Publishing (OIDC): no token in the workflow or in repository secrets, because PyPI mints a short-lived credential from the GitHub OIDC token. The version guard reads pyproject.toml textually rather than with tomllib. The guard runs before setup-python so it must not depend on an interpreter, and tomllib would rule out the 3.9 the package still supports — the sibling guards in the Java and JavaScript releases are textual for the same reason. Publishing builds on a single interpreter: the wheel is pure Python and carries requires-python from the metadata, so the build interpreter cannot shape the artifact, and the 3.9/3.12 compatibility matrix already runs on every push to main. The suite still re-runs here so the uploaded artifacts are the ones it passed against. The pypi.org trusted-publisher entry is a one-time manual step, documented in sdk/python/README.md -> Releasing.
rmyndharis
force-pushed
the
ci/python-sdk-trusted-publishing
branch
from
August 6, 2026 03:16
872ecac to
8a25b34
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
rmyndharis-openwareached PyPI once, manually, and has sat at 0.1.0 since. This adds a tag-triggered publish workflow matchingjs-sdk-release.yml.Change
Authentication is PyPI Trusted Publishing (OIDC). No PyPI token exists in the workflow or in repository secrets — PyPI mints a short-lived credential from the GitHub OIDC token, so nothing long-lived exists to leak or rotate.
Details worth reviewing:
pyproject.tomltextually, not withtomllib. The guard runs beforesetup-pythonso it must not depend on an interpreter being present, andtomllibwould rule out the 3.9 this package still supports. The Java and JavaScript guards are textual for the same reason. Verified against the real file: it extracts0.1.0.py3-none-any) and carriesrequires-pythonfrom the metadata, so the build interpreter cannot shape the artifact, and the 3.9/3.12 compatibility matrix already runs on every push tomain. The suite still re-runs here so the uploaded artifacts are the ones it passed against.workflow_dispatchis restricted to the samepy-sdk-v*tag shape a push triggers on, so an arbitrary branch or a monorepov*app tag cannot reach PyPI, and the tag version must matchpyproject.toml.pypa/gh-action-pypi-publishis pinned to the commit SHA behindv1.14.2, matching how every other third-party action in this repository is pinned. Note the release ref is an annotated tag, so the tag object's SHA is not the commit SHA — the pin dereferences to the commit.One-time setup required before the first tag
The pypi.org side cannot be automated. In the project's publishing settings, add a GitHub trusted publisher: owner
rmyndharis, repositoryOpenWA, workflowpython-sdk-release.yml. Until that exists PyPI rejects the upload. Documented insdk/python/README.md-> Releasing.No repository secrets are needed.