Switch to Trusted Publisher method in runner-publish.yml

mlcommons · Jul 27, 2023 · d975156 · d975156
1 parent 2a417d5
commit d975156
Showing 1 changed file with 12 additions and 12 deletions.
diff --git a/.github/workflows/runner-publish.yml b/.github/workflows/runner-publish.yml
@@ -10,6 +10,8 @@ on:
 jobs:
   ssh_deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/checkout@v2
     - name: Set up Python
@@ -27,17 +29,17 @@ jobs:
     - name: Publish
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: ${{ secrets.PYPI_USER }}
         verify_metadata: true
         skip_existing: true
-        password: ${{ secrets.PYPI_PASSWORD }}
         packages_dir: runners/mlcube_ssh/dist/
         repository_url: https://upload.pypi.org/legacy/
       env:
         LOGLEVEL: DEBUG
 
   docker_deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/checkout@v2
     - name: Set up Python
@@ -55,10 +57,8 @@ jobs:
     - name: Publish
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: ${{ secrets.PYPI_USER }}
         verify_metadata: true
         skip_existing: true
-        password: ${{ secrets.PYPI_PASSWORD }}
         packages_dir: runners/mlcube_docker/dist/
         repository_url: https://upload.pypi.org/legacy/
         verbose: true
@@ -67,6 +67,8 @@ jobs:
 
   singularity_deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/checkout@v2
     - name: Set up Python
@@ -84,10 +86,8 @@ jobs:
     - name: Publish
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: ${{ secrets.PYPI_USER }}
         verify_metadata: true
         skip_existing: true
-        password: ${{ secrets.PYPI_PASSWORD }}
         packages_dir: runners/mlcube_singularity/dist/
         repository_url: https://upload.pypi.org/legacy/
         verbose: true
@@ -96,6 +96,8 @@ jobs:
 
   kubernetes_runner_deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/checkout@v2
     - name: Set up Python
@@ -113,10 +115,8 @@ jobs:
     - name: Publish
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: ${{ secrets.PYPI_USER }}
         verify_metadata: true
         skip_existing: true
-        password: ${{ secrets.PYPI_PASSWORD }}
         packages_dir: runners/mlcube_k8s/dist/
         repository_url: https://upload.pypi.org/legacy/
         verbose: true
@@ -125,6 +125,8 @@ jobs:
 
   gcp_runner_deploy:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
     - uses: actions/checkout@v2
     - name: Set up Python
@@ -142,10 +144,8 @@ jobs:
     - name: Publish
       uses: pypa/gh-action-pypi-publish@release/v1
       with:
-        user: ${{ secrets.PYPI_USER }}
         verify_metadata: true
         skip_existing: true
-        password: ${{ secrets.PYPI_PASSWORD }}
         packages_dir: runners/mlcube_gcp/dist/
         repository_url: https://upload.pypi.org/legacy/
         verbose: true
@@ -154,6 +154,8 @@ jobs:
 
   kubeflow_runner_deploy:
       runs-on: ubuntu-latest
+      permissions:
+        id-token: write
       steps:
       - uses: actions/checkout@v2
       - name: Set up Python
@@ -171,10 +173,8 @@ jobs:
       - name: Publish
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          user: ${{ secrets.PYPI_USER }}
           verify_metadata: true
           skip_existing: true
-          password: ${{ secrets.PYPI_PASSWORD }}
           packages_dir: runners/mlcube_kubeflow/dist/
           repository_url: https://upload.pypi.org/legacy/
           verbose: true