This is an automated email from the ASF dual-hosted git repository.
JingsongLi pushed a commit to branch release-2.0
in repository https://gitbox.apache.org/repos/asf/paimon.git
The following commit(s) were added to refs/heads/release-2.0 by this push:
new 6f8296c305 Use repository secrets for PyPI publishing
6f8296c305 is described below
commit 6f8296c305a6e7a65c71100de53f8c0349dde114
Author: JingsongLi <[email protected]>
AuthorDate: Fri Jul 31 11:09:12 2026 +0800
Use repository secrets for PyPI publishing
---
.github/workflows/release-python-publish.yml | 7 +++++--
.github/workflows/release.yml | 3 +++
docs/docs/project/creating-a-release.md | 27 ++++++++++-----------------
3 files changed, 18 insertions(+), 19 deletions(-)
diff --git a/.github/workflows/release-python-publish.yml
b/.github/workflows/release-python-publish.yml
index eaa2af9eb1..a38eb34a09 100644
--- a/.github/workflows/release-python-publish.yml
+++ b/.github/workflows/release-python-publish.yml
@@ -20,6 +20,11 @@ name: Release PyPaimon Publish
on:
workflow_call:
+ secrets:
+ TEST_PYPI_API_TOKEN:
+ required: true
+ PYPI_API_TOKEN:
+ required: true
concurrency:
group: release-python-publish-${{ github.ref }}
@@ -35,8 +40,6 @@ jobs:
if: >-
github.repository == 'apache/paimon' &&
startsWith(github.ref, 'refs/tags/')
- environment:
- name: ${{ contains(github.ref_name, '-rc') && 'testpypi' || 'pypi' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e9f14bf483..383a011d29 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -127,3 +127,6 @@ jobs:
(needs.java.result == 'success' ||
needs.validation.outputs.release_kind == 'final')
uses: ./.github/workflows/release-python-publish.yml
+ secrets:
+ TEST_PYPI_API_TOKEN: ${{ secrets.TEST_PYPI_API_TOKEN }}
+ PYPI_API_TOKEN: ${{ secrets.PYPI_API_TOKEN }}
diff --git a/docs/docs/project/creating-a-release.md
b/docs/docs/project/creating-a-release.md
index bfe20952e6..55da4ed04a 100644
--- a/docs/docs/project/creating-a-release.md
+++ b/docs/docs/project/creating-a-release.md
@@ -96,15 +96,11 @@ release blocker.
The Java jobs use `-Dgpg.skip=true` and never receive Nexus credentials or a
GPG private key. Their artifacts are build evidence, not the Maven staging
-repositories used for the vote. The Python RC job uses the protected
-`testpypi` environment to publish `PYPAIMON_VERSIONrcRC_NUMBER` to TestPyPI.
-The final job uses the separate protected `pypi` environment.
-
-Configure both environments with an RM approval and a deployment policy which
-allows only the corresponding signed release tags. Store
-`TEST_PYPI_API_TOKEN` only in `testpypi` and `PYPI_API_TOKEN` only in `pypi`.
-Do not store either token as a repository or organization secret, and do not
-pass unrelated secrets to the reusable publishing workflow.
+repositories used for the vote. The Python RC job uses the
+`TEST_PYPI_API_TOKEN` repository Actions secret to publish
+`PYPAIMON_VERSIONrcRC_NUMBER` to TestPyPI. The final job uses the
+`PYPI_API_TOKEN` repository Actions secret to publish to PyPI. The release
+workflow passes only these two secrets to the reusable publishing workflow.
## One-time RM setup
@@ -122,12 +118,9 @@ Before managing the first release:
GitHub Actions.
5. Confirm access to the ASF distribution SVN repository, Apache Nexus,
TestPyPI, and PyPI.
-6. Create the protected GitHub environments `testpypi` and `pypi`. Configure
- required RM reviewers and release-tag deployment policies, store only the
- matching token in each environment, and remove any repository- or
- organization-level copies of those tokens.
-7. Verify that the Python release secrets are configured without printing
- their values in an Actions log.
+6. Verify that the repository Actions secrets `TEST_PYPI_API_TOKEN` and
+ `PYPI_API_TOKEN` are configured without printing their values in an Actions
+ log.
```shell
gpg --list-secret-keys --keyid-format LONG
@@ -445,8 +438,8 @@ svn mv -m "Release PyPaimon ${PYPAIMON_VERSION}" \
is still closed and has the exact artifact tree approved by the vote.
2. Release those exact closed repositories to Maven Central. Do not run Maven
deploy again.
-3. Approve the protected `pypi` promotion job for the final tag. It must build
- `pypaimon==PYPAIMON_VERSION` from the approved tag commit and must not
change
+3. Confirm that the final tag's PyPI publish job builds
+ `pypaimon==PYPAIMON_VERSION` from the approved tag commit and does not
change
project source.
4. Verify Maven Central and PyPI before announcing the release.
