PyPI CI/CD credentials: long-lived API token or Trusted Publishing
Choose between a long-lived PyPI API token and Trusted Publishing (OIDC) for CI/CD package uploads, with trade-offs, a GitHub Actions example, and validation steps.
Loading…
ReadMeFeed / Community knowledge
Pypi
Real questions. Useful conversations. Find the people who know your stack.
Pypi
Developer tools · #pypi
Choosing Between manylinux and musllinux Wheels for PyPI Packages
Learn how manylinux and musllinux wheels let you skip compilation, ensure binary compatibility across Linux distros, and what trade-offs to consider when publishing PyPI packages.
Eliminating Long-Lived Secrets with PyPI Trusted Publishers
Stop storing long-lived PyPI tokens in your CI/CD secrets. Learn how to use Trusted Publishers and OIDC to establish a secure, identity-based publishing workflow.
Drop Long-Lived PyPI Tokens: A Practical Guide to Trusted Publishing
Long-lived PyPI API tokens in CI are a standing risk. Trusted Publishing uses OpenID Connect to issue short-lived, workflow-scoped credentials automatically—here is how to wire it up and what to watch for.
Choosing Between Trusted Publishing (OIDC) and Scoped API Tokens for PyPI CI/CD
When automating Python package uploads to PyPI, you must decide between the new Trusted Publishing flow that uses OIDC tokens and the classic scoped API tokens. This guide compares security, setup, and practical steps for GitHub Actions, GitLab, and other CI providers.
PyPI Trusted Publishing: OIDC‑Based, Tokenless Uploads for CI/CD
Learn how PyPI’s Trusted Publishing uses OIDC to replace static tokens in CI/CD pipelines, with a step‑by‑step GitHub Actions example, trade‑offs, and a quick verification checklist.
Architecting PyPI PGP Signature Verification in CI Pipelines
Learn how to design a minimal, trust‑bound PyPI PGP verification step for CI, covering requirements, key management, operational checks, and failure modes.
From Setup.py Chaos to Reproducible Builds: Why PyPI’s PEP 517/518 Matters
PyPI’s PEP 517/518 build system lets you declare a build backend and dependencies in pyproject.toml, creating isolated, reproducible wheels. Learn how to migrate from setup.py, see a concrete example, and weigh the trade‑offs.
Publish Wheels to PyPI for Faster Reliable Installs
Wheels let pip install pre-built packages without a compiler. See how to build, upload and verify a wheel for a small C extension on PyPI.