mirror of
https://github.com/lancedb/lancedb.git
synced 2026-05-14 02:20:40 +00:00
ef399de092
## Summary - Replaces `LANCEDB_PYPI_API_TOKEN` (long-lived token) with OIDC trusted publishing via `pypa/gh-action-pypi-publish` - Adds `id-token: write` permission to linux/mac/windows jobs - Removes `twine`-based upload and the `pypi_token` input from `upload_wheel` composite action - Enables PEP 740 Sigstore attestations on published wheels as a bonus After merging, rotate/revoke the `LANCEDB_PYPI_API_TOKEN` secret. Closes #3294 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
35 lines
917 B
YAML
35 lines
917 B
YAML
name: upload-wheel
|
|
|
|
description: "Upload wheels to Pypi"
|
|
inputs:
|
|
fury_token:
|
|
required: true
|
|
description: "release token for the fury repo"
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Choose repo
|
|
shell: bash
|
|
id: choose_repo
|
|
run: |
|
|
if [[ ${{ github.ref }} == *beta* ]]; then
|
|
echo "repo=fury" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "repo=pypi" >> $GITHUB_OUTPUT
|
|
fi
|
|
- name: Publish to Fury
|
|
if: steps.choose_repo.outputs.repo == 'fury'
|
|
shell: bash
|
|
env:
|
|
FURY_TOKEN: ${{ inputs.fury_token }}
|
|
run: |
|
|
WHEEL=$(ls target/wheels/lancedb-*.whl 2> /dev/null | head -n 1)
|
|
echo "Uploading $WHEEL to Fury"
|
|
curl -f -F package=@$WHEEL https://$FURY_TOKEN@push.fury.io/lancedb/
|
|
- name: Publish to PyPI
|
|
if: steps.choose_repo.outputs.repo == 'pypi'
|
|
uses: pypa/gh-action-pypi-publish@release/v1
|
|
with:
|
|
packages-dir: target/wheels/
|