PyPI CI/CD credentials: long-lived API token or Trusted Publishing
Choose between a long-lived PyPI API token and Trusted Publishing (OIDC) for CI/CD package uploads, with trade-offs, a GitHub Actions example, and validation steps.
Loading…
pypiDrop Long-Lived PyPI Tokens: A Practical Guide to Trusted Publishing
Long-lived PyPI API tokens in CI are a standing risk. Trusted Publishing uses OpenID Connect to issue short-lived, workflow-scoped credentials automatically—here is how to wire it up and what to watch for.