From 8f2b5b45acb013d13e0268e5eaf47c0be4cc27a5 Mon Sep 17 00:00:00 2001 From: Mike McDougall Date: Tue, 4 Aug 2026 20:20:42 -1000 Subject: [PATCH] ci: bind PyPI publish jobs to per-package environments PyPI rejects two pending trusted publishers with an identical repo/workflow/environment tuple, so the honua-sdk and honua-admin publishers could not both be registered against the bare workflow. Bind each publish job to its own GitHub environment (pypi-honua-sdk, pypi-honua-admin) so the two OIDC configurations are distinct. --- .github/workflows/publish-python-sdk.yml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/publish-python-sdk.yml b/.github/workflows/publish-python-sdk.yml index 3d73810..83abdc6 100644 --- a/.github/workflows/publish-python-sdk.yml +++ b/.github/workflows/publish-python-sdk.yml @@ -80,12 +80,16 @@ jobs: (github.event_name == 'push' && startsWith(github.ref_name, 'python-sdk-v')) || (github.event_name == 'workflow_dispatch' && (github.event.inputs.package == 'honua-sdk' || github.event.inputs.package == 'both')) runs-on: ubuntu-latest + environment: pypi-honua-sdk # PyPI Trusted Publishing requires `id-token: write` so the action can mint # an OIDC token and exchange it for a short-lived upload credential. The # Trusted Publisher MUST be configured at: # https://pypi.org/manage/project/honua-sdk/settings/publishing/ - # with workflow `publish-python-sdk.yml` (and the matching environment, if - # any) bound to this repository. See: https://docs.pypi.org/trusted-publishers/ + # with workflow `publish-python-sdk.yml` and environment `pypi-honua-sdk` + # bound to this repository. The per-package environment names keep the two + # publishers' OIDC configurations distinct — PyPI rejects two pending + # publishers with an identical repo/workflow/environment tuple. + # See: https://docs.pypi.org/trusted-publishers/ permissions: contents: read id-token: write @@ -166,12 +170,16 @@ jobs: (github.event_name == 'push' && startsWith(github.ref_name, 'python-admin-v')) || (github.event_name == 'workflow_dispatch' && (github.event.inputs.package == 'honua-admin' || github.event.inputs.package == 'both')) runs-on: ubuntu-latest + environment: pypi-honua-admin # PyPI Trusted Publishing requires `id-token: write` so the action can mint # an OIDC token and exchange it for a short-lived upload credential. The # Trusted Publisher MUST be configured at: # https://pypi.org/manage/project/honua-admin/settings/publishing/ - # with workflow `publish-python-sdk.yml` (and the matching environment, if - # any) bound to this repository. See: https://docs.pypi.org/trusted-publishers/ + # with workflow `publish-python-sdk.yml` and environment `pypi-honua-admin` + # bound to this repository. The per-package environment names keep the two + # publishers' OIDC configurations distinct — PyPI rejects two pending + # publishers with an identical repo/workflow/environment tuple. + # See: https://docs.pypi.org/trusted-publishers/ permissions: contents: read id-token: write