PyPI upload from GitHub Actions without API token

Readme.md

For each package, go into PyPI projects and add a publisher.

This uses separate jobs for build and publish as recommended to avoid a poisoned package from hijacking the publish to put hostile code in a package.

publish-pypi.yml

# https://docs.pypi.org/trusted-publishers/using-a-publisher/

name: publish

on:
  release:
    types: [published]

jobs:

  build:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.x'

    - name: Install builder
      run: pip install build

    - name: Build package
      run: python -m build

    - name: upload artifacts
      uses: actions/upload-artifact@v4
      with:
        name: python-dist
        path: dist/


  pypi-publish:

    needs: build

    runs-on: ubuntu-latest

    environment:
      name: pypi

    permissions:
      id-token: write

    steps:

    - name: Download all the dists
      uses: actions/download-artifact@v4
      with:
        name: python-dist
        path: dist/

    - name: Publish package
      uses: pypa/gh-action-pypi-publish@release/v1