Use trusted publishing instead of PYPI password/username

kyuridenamida · web-flow · commit 455cb9c00128 · 2024-06-08T04:30:53.000+09:00
diff --git a/.github/workflows/upload-python-package.yml b/.github/workflows/upload-python-package.yml
@@ -6,6 +6,9 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    environment: stable
+    permissions:
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v2
@@ -25,11 +28,8 @@ jobs:
       - name: Install Dependencies
         run: poetry install --no-interaction
       - name: Build and publish
-        env:
-          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
         run: |
           rm -rf dist/
           poetry build
-          poetry run twine upload dist/*
-
+      - name: Publish package distributions to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
