|
9 | 9 | release: |
10 | 10 | if:github.repository == 'python-gitlab/python-gitlab' |
11 | 11 | runs-on:ubuntu-latest |
| 12 | +permissions: |
| 13 | +id-token:write |
| 14 | +environment:pypi.org |
12 | 15 | steps: |
13 | 16 | -uses:actions/checkout@v3.5.0 |
14 | 17 | with: |
15 | 18 | fetch-depth:0 |
16 | 19 | token:${{ secrets.RELEASE_GITHUB_TOKEN }} |
| 20 | + -name:mint API token |
| 21 | +id:mint-token |
| 22 | +run:| |
| 23 | + resp=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=pypi") |
| 24 | + oidc_token=$(jq '.value' <<< "${resp}") |
| 25 | +
|
| 26 | + resp=$(curl -X POST https://pypi.org/_/oidc/github/mint-token -d "{\"token\":${oidc_token}}") |
| 27 | + api_token=$(jq '.token' <<< "${resp}" | tr -d '"') |
| 28 | +
|
| 29 | + echo "::add-mask::${api_token}" |
| 30 | + echo "api-token=${api_token}" >> "${GITHUB_OUTPUT}" |
17 | 31 | -name:Python Semantic Release |
18 | 32 | uses:relekang/python-semantic-release@v7.33.2 |
19 | 33 | with: |
20 | 34 | github_token:${{ secrets.RELEASE_GITHUB_TOKEN }} |
21 | | -pypi_token:${{secrets.PYPI_TOKEN }} |
| 35 | +pypi_token:${{steps.mint-token.outputs.api-token }} |