Move to pypi trusted publishing (#718)

* Move to pypi trusted publishing * Tidy.
FEniCS · Oct 10, 2024 · a5616d8 · a5616d8
1 parent e36cd00
commit a5616d8
Showing 1 changed file with 37 additions and 18 deletions.
diff --git a/.github/workflows/build-wheels.yml b/.github/workflows/build-wheels.yml
@@ -11,11 +11,11 @@ on:
         default: "main"
         type: string
       test_pypi_publish:
-        description: "Publish to Test PyPi (true | false)"
+        description: "Publish to Test PyPi"
         default: false
         type: boolean
       pypi_publish:
-        description: "Publish to PyPi (true | false)"
+        description: "Publish to PyPi"
         default: false
         type: boolean
 
@@ -26,11 +26,11 @@ on:
         default: "main"
         type: string
       test_pypi_publish:
-        description: "Publish to Test PyPi (true | false)"
+        description: "Publish to Test PyPi"
         default: false
         type: boolean
       pypi_publish:
-        description: "Publish to PyPi (true | false))"
+        description: "Publish to PyPi"
         default: false
         type: boolean
 
@@ -49,27 +49,46 @@ jobs:
         run: python -m build .
       - uses: actions/upload-artifact@v4
         with:
-          path: dist/*
-  upload_pypi:
-    name: Upload to PyPI (optional)
+          path: dist/* 
+
+  upload_test_pypi:
+    name: Upload to test PyPI (optional)
+    if: ${{ github.event.inputs.test_pypi_publish == 'true' }}
     needs: [build]
     runs-on: ubuntu-latest
+    environment:
+      name: testpypi
+      url: https://test.pypi.org/p/fenics-ffcx
+    permissions:
+      id-token: write
+
     steps:
       - uses: actions/download-artifact@v4
         with:
           name: artifact
           path: dist
-      - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
-        if: ${{ github.event.inputs.pypi_publish == 'true' }}
-        with:
-          user: __token__
-          password: ${{ secrets.PYPI_TOKEN }}
-          repository-url: https://upload.pypi.org/legacy/
-      - name: Publish to Test PyPI
+
+      - name: Push to test PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        if: ${{ github.event.inputs.test_pypi_publish == 'true' }}
         with:
-          user: __token__
-          password: ${{ secrets.PYPI_TEST_TOKEN }}
           repository-url: https://test.pypi.org/legacy/
+
+  upload_pypi:
+    name: Upload to PyPI (optional)
+    if: ${{ github.event.inputs.pypi_publish == 'true' }}
+    needs: [build]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/fenics-ffcx
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: artifact
+          path: dist
+
+      - name: Push to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1