yangxk1 opened a new pull request, #933: URL: https://github.com/apache/incubator-graphar/pull/933
### Reason for this PR The `pypa/gh-action-pypi-publish` action is not in the Apache organization's GitHub Actions allowlist, causing the `upload_test_pypi` and `upload_pypi` jobs to fail with: > The actions pypa/gh-action-pypi-publish@release/v1 and pypa/gh-action-pypi-publish@release/2473ec6c6aa87f38946284d51289219fd0b87264 are not allowed in apache/incubator-graphar See: https://github.com/apache/incubator-graphar/actions/runs/27183446921 ### What changes are included in this PR? Replace both uses of `pypa/gh-action-pypi-publish` with inline shell steps that perform the same trusted publisher OIDC flow directly: 1. Request an OIDC token from GitHub Actions (using the existing `id-token: write` permission) 2. Exchange it with PyPI/TestPyPI for a short-lived API token via the `_/oidc/mint-token` endpoint 3. Upload packages using `twine` Additionally, `::add-mask::` is used to prevent the minted token from leaking in CI logs. ### Are these changes tested? The OIDC flow follows PyPI's [official trusted publisher documentation](https://docs.pypi.org/trusted-publishers/using-a-publisher/). The workflow YAML has been validated for correct syntax. The actual upload will be tested when the workflow runs on the next push to `main`. ### Are there any user-facing changes? No. The publishing behavior is identical — packages are still uploaded via PyPI trusted publishing (OIDC). Only the CI implementation changes. ## Checklist - [x] I have performed a self-review of my own code. - [ ] I have formatted my own code using `make cpplint` before submitting when changed files are in the `cpp` directory. - [x] I have performed `pre-commit run` before commit the changed files. - [ ] I have added tests to prove my changes are effective. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
