You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
langchain/.github/workflows
Predrag Gruevski 9f08d29bc8
Use PyPI Trusted Publishing to publish langchain packages. (#9467)
Trusted Publishing is the current best practice for publishing Python
packages. Rather than long-lived secret keys, it uses OpenID Connect
(OIDC) to allow our GitHub runner to directly authenticate itself to
PyPI and get a short-lived publishing token. This locks down publishing
quite a bit:
- There's no long-lived publish key to steal anymore.
- Publishing is *only* allowed via the *specifically designated* GitHub
workflow in the designated repo.

It also is operationally easier: no keys means there's nothing that
needs to be periodically rotated, nothing to worry about leaking, and
nobody can accidentally publish a release from their laptop because they
happened to have PyPI keys set up.

After this gets merged, we'll need to configure PyPI to start expecting
trusted publishing. It's only a few clicks and should only take a
minute; instructions are here:
https://docs.pypi.org/trusted-publishers/adding-a-publisher/

More info:
- https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/
- https://github.com/pypa/gh-action-pypi-publish
1 year ago
..
_lint.yml Fix conditional that erroneously always runs. (#9543) 1 year ago
_release.yml Use PyPI Trusted Publishing to publish langchain packages. (#9467) 1 year ago
_test.yml Upgrade CI poetry version to 1.5.1. (#9479) 1 year ago
codespell.yml Add api cross ref linking (#8275) 1 year ago
langchain_ci.yml unpin pydantic (#9356) 1 year ago
langchain_experimental_ci.yml scheduled tests GHA (#8879) 1 year ago
langchain_experimental_release.yml Require manually triggering release workflows. (#9552) 1 year ago
langchain_release.yml Require manually triggering release workflows. (#9552) 1 year ago
scheduled_test.yml Upgrade CI poetry version to 1.5.1. (#9479) 1 year ago