From 847c5bddd7970d8eab61b67e85094912cb1a4ce6 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 12:54:06 +0000 Subject: [PATCH] ci(release): publish e2b-charts to PyPI via trusted publishing Co-Authored-By: mish@e2b.dev --- .github/workflows/release.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c4e78062..d2db09d4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -147,13 +147,12 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Release new versions + # OIDC trusted publishing (`id-token: write` above), as in e2b-dev/E2B, + # instead of a long-lived PyPI token that expires and 403s the release. run: | uv build - uv publish --check-url https://pypi.org/simple/ + uv publish --trusted-publishing always --check-url https://pypi.org/simple/ working-directory: ./chart_data_extractor - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - UV_PUBLISH_TOKEN: ${{ secrets.CHARTS_PYPI_TOKEN }} - name: Output new version id: output_version @@ -350,7 +349,6 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} NPM_TOKEN: "" # See https://github.com/changesets/changesets/issues/1152#issuecomment-3190884868 - PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }} - name: Push new versions # Gate on the tags rather than on whether the publish step succeeded: they