ci/python-publish: bump, use trusted publishing

[woodruffw]

Fixes #2344.

Tasks

For all workflows, the workflow:

• Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
• Should use sentence case for the names of workflows and steps (for example, "Run tests").
• Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
• Should include comments in the workflow for any parts that are not obvious or could use clarification.
• Should specify least privileged permissions for GITHUB_TOKEN so that the workflow runs successfully.

For CI workflows, the workflow:

• Should be preserved under the ci directory.
• Should include a matching ci/properties/*.properties.json file (for example, ci/properties/docker-publish.properties.json).
• Should run on push to branches: [ $default-branch ] and pull_request to branches: [ $default-branch ].
• Packaging workflows should run on release with types: [ created ].
• Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, docker-publish.yml).

Some general notes:

• This workflow must only use actions that are produced by GitHub, in the actions organization, or
• This workflow must only use actions that are produced by the language or ecosystem that the workflow supports. These actions must be published to the GitHub Marketplace. We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file:

  # This workflow uses actions that are not certified by GitHub.
  # They are provided by a third-party and are governed by
  # separate terms of service, privacy policy, and support
  # documentation.
  

• Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
• Automation and CI workflows cannot be dependent on a paid service or product.

[woodruffw]

xref #2344, github/docs#32146

CC @di @jhutchings1

CC @webknjaz as well, as the maintainer of gh-action-pypi-publish 🙂

[jhutchings1]

@juliandunn @N-Usha FYI, I've been in discussion with @woodruffw, @di and the PyPI team about this. This change switches from using token based authentication to OIDC, and would be a great benefit to the security posture of this community. Let me know if you have any questions I can help with to get the review prioritized by Actions engineering.

[webknjaz]

@woodruffw love that this is moving somewhere! Thank you for getting to this sooner than me :) I've been frustrated with how many people get pre-historic workflows by default and don't even know it...

One extra thing to consider — it might be useful to also stick Sigstore signing right into the starter. OTOH, giving people a link to the guide might be an alternative.

[webknjaz]

I've been in discussion with @woodruffw, @di and the PyPI team about this.

Linking some context: pypa/gh-action-pypi-publish#123 (comment)

[woodruffw]

One extra thing to consider — it might be useful to also stick Sigstore signing right into the starter. OTOH, giving people a link to the guide might be an alternative.

I'd personally like to shy away from suggesting the Sigstore action here for now, if only because (with PEP 740) it'll become obsolete and integrated directly into the publishing flow 🙂

[woodruffw]

This should be good to go. I think it might make sense to review and land this before github/docs#32146, since the workflow changes here will need to be reflected there as well.

[woodruffw]

Gentle ping for review here!

(@jhutchings1 I'm calling in that promise 😉)

[woodruffw]

Gentle ping -- this has been sitting for a while now and is now behind the other GitHub docs (and PyPI/PyPUG docs) in terms of what it contains.

CC @jhutchings1 @nebuk89

[jhutchings1]

I'm really bummed this one hasn't gotten traction. I'm not an employee anymore, so don't have any official seat, but @chrispat anything you can do to get this one some love?

[jhutchings1]

I'm really bummed this one hasn't gotten traction. I'm not an employee anymore, so don't have any official seat, but @chrispat anything you can do to get this one some love?

[steiza]

3 minor comments, otherwise looks good to me! I was able to use this workflow successfully.

[woodruffw]

Thanks @steiza, applied!

[steiza]

Fantastic; thanks! I think this is ready to merge.

[woodruffw]

Thanks a ton @steiza and @elbrenn!

[Mohammed-Alanazisa]

Fixes #2344.

Tasks

For all workflows, the workflow:

* [x]  Should be contained in a `.yml` file with the language or platform as its filename, in lower, [_kebab-cased_](https://en.wikipedia.org/wiki/Kebab_case) format (for example, [`docker-image.yml`](https://github.com/actions/starter-workflows/blob/main/ci/docker-image.yml)).  Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").

* [x]  Should use sentence case for the names of workflows and steps (for example, "Run tests").

* [x]  Should be named _only_ by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").

* [x]  Should include comments in the workflow for any parts that are not obvious or could use clarification.

* [x]  Should specify least privileged [permissions](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token) for `GITHUB_TOKEN` so that the workflow runs successfully.

For CI workflows, the workflow:

* [x]  Should be preserved under [the `ci` directory](https://github.com/actions/starter-workflows/tree/main/ci).

* [ ]  Should include a matching `ci/properties/*.properties.json` file (for example, [`ci/properties/docker-publish.properties.json`](https://github.com/actions/starter-workflows/blob/main/ci/properties/docker-publish.properties.json)).

* [x]  Should run on `push` to `branches: [ $default-branch ]` and `pull_request` to `branches: [ $default-branch ]`.

* [x]  Packaging workflows should run on `release` with `types: [ created ]`.

* [x]  Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, [`docker-publish.yml`](https://github.com/actions/starter-workflows/blob/main/ci/docker-publish.yml)).

Some general notes:

* [x]  This workflow must _only_ use actions that are produced by GitHub, [in the `actions` organization](https://github.com/actions), **or**

* [x]  This workflow must _only_ use actions that are produced by the language or ecosystem that the workflow supports.  These actions must be [published to the GitHub Marketplace](https://github.com/marketplace?type=actions).  We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag.  Additionally, workflows must include the following comment at the top of the workflow file:
  ```
  # This workflow uses actions that are not certified by GitHub.
  # They are provided by a third-party and are governed by
  # separate terms of service, privacy policy, and support
  # documentation.
  ```

* [x]  Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.

* [x]  Automation and CI workflows cannot be dependent on a paid service or product.

[Mohammed-Alanazisa]

gh pr checkout 2345

[webknjaz]

Thanks @elbrenn and @steiza!

[Mohammed-Alanazisa]

gh pr checkout 2345

[nanobugsbozbitcH]

Qutiom-nano-codesandbox.com.ioa-ai.io

[965022-oss]

Merge #2345 ci/python-publish: bump
use trusted publishing
Branch: main
965022-oss-patch3
SHA: f4dbb8424c