andrewmusselman commented on issue #751: URL: https://github.com/apache/tooling-trusted-releases/issues/751#issuecomment-5050341661
> [@andrewmusselman](https://github.com/andrewmusselman) We need a table of all of the distribution channels, if there is a staging version, and, most importantly if there is a preferred and trusted publishing action accessible in GitHub. Bonus if that GH action is already approved in `apache/infrastructure-actions` # Publishing Detail: apache Enriched analysis of **1168** repositories with publishing workflows. ## Overview - **1168** repos with publishing workflows - **4533** workflows analyzed - **310** distinct stored secrets - **236** unpinned publishing actions ## Production Channels | Channel | Repos | Report | |---------|-------|--------| | Apache dist (release) | 3 | [channels/apache_dist_release.md](channels/apache_dist_release.md) | | crates.io | 27 | [channels/crates_io.md](channels/crates_io.md) | | Docker Hub | 137 | [channels/docker_hub.md](channels/docker_hub.md) | | GitHub Releases | 33 | [channels/github_releases.md](channels/github_releases.md) | | Helm | 14 | [channels/helm.md](channels/helm.md) | | Maven Central | 40 | [channels/maven_central.md](channels/maven_central.md) | | npm | 19 | [channels/npm.md](channels/npm.md) | | NuGet | 10 | [channels/nuget.md](channels/nuget.md) | | Puppet Forge | 1 | [channels/puppet_forge.md](channels/puppet_forge.md) | | PyPI | 32 | [channels/pypi.md](channels/pypi.md) | | RubyGems | 2 | [channels/rubygems.md](channels/rubygems.md) | | VS Code Marketplace | 1 | [channels/vscode_marketplace.md](channels/vscode_marketplace.md) | ## Staging Channels | Channel | Repos | Report | |---------|-------|--------| | Apache dist (dev) | 22 | [channels/apache_dist_dev.md](channels/apache_dist_dev.md) | | ghcr.io | 69 | [channels/ghcr.md](channels/ghcr.md) | | GitHub Packages | 4 | [channels/github_packages.md](channels/github_packages.md) | | GitHub Pages | 74 | [channels/github_pages.md](channels/github_pages.md) | | Maven Snapshots | 4 | [channels/maven_snapshots.md](channels/maven_snapshots.md) | | Apache Nightlies | 8 | [channels/nightlies.md](channels/nightlies.md) | | TestPyPI | 17 | [channels/test_pypi.md](channels/test_pypi.md) | ## Executive Summary | Metric | Value | |--------|-------| | Repositories scanned | 2499 | | Repositories with workflows | 1185 | | Total workflow files | 4722 | | **Repos publishing to registries** | **335** | | Release artifact workflows | 335 | | Snapshot / nightly workflows | 169 | | CI infrastructure image workflows | 68 | | Documentation / website workflows | 235 | | Security notes flagged | 2354 | ## Package Ecosystem Distribution (releases + snapshots only) | Ecosystem | Workflows | Percentage | |-----------|-----------|------------| | maven_central | 155 | 22.5% | | github_releases | 130 | 18.9% | | docker_hub | 114 | 16.6% | | pypi | 70 | 10.2% | | ghcr | 44 | 6.4% | | apache_dist | 44 | 6.4% | | crates_io | 33 | 4.8% | | npm | 33 | 4.8% | | helm | 18 | 2.6% | | github_pages | 15 | 2.2% | | nuget | 11 | 1.6% | | gcr | 7 | 1.0% | | github_packages | 5 | 0.7% | | s3 | 4 | 0.6% | | rubygems | 3 | 0.4% | | hex | 1 | 0.1% | | gcs | 1 | 0.1% | ## Already Using Trusted Publishing These workflows publish to OIDC-capable ecosystems and are already using Trusted Publishing — no stored secrets needed for publishing. ### crates.io | Repository | Workflow | Auth Method | Category | |------------|----------|------------|----------| | fory | `release-rust.yaml` | OIDC via rust-lang/crates-io-auth-action (id-token: write), token stored in CARGO_REGISTRY_TOKEN env var | Release Artifacts | | iceberg-rust | `publish.yml` | OIDC trusted publishing (id-token: write) for both crates.io and PyPI | Release Artifacts | | opendal | `release_rust.yml` | OIDC via rust-lang/crates-io-auth-action with fallback to secrets.CARGO_REGISTRY_TOKEN | Release Artifacts | | sedona-spatialbench | `spatialbench-publish-crates.yml` | OIDC token exchange via rust-lang/crates-io-auth-action | Release Artifacts | | thrift | `release_rust.yml` | OIDC via rust-lang/crates-io-auth-action (id-token: write), token passed via CARGO_REGISTRY_TOKEN env var | Release Artifacts | ### npm | Repository | Workflow | Auth Method | Category | |------------|----------|------------|----------| | fory | `release-javascript.yaml` | npm trusted publishing (OIDC via id-token: write permission, no auth token) | Release Artifacts | | opendal | `release_nodejs.yml` | npm trusted publishing (OIDC via id-token: write permission), GITHUB_TOKEN for GitHub context | Release Artifacts | | superset | `embedded-sdk-release.yml` | npm OIDC trusted publishing (id-token: write, no NPM_TOKEN) | Release Artifacts | ### NuGet | Repository | Workflow | Auth Method | Category | |------------|----------|------------|----------| | fory | `release-csharp.yaml` | GitHub OIDC token exchanged for NuGet API key via NuGet token service (https://www.nuget.org/api/v2/token) | Release Artifacts | | opendal | `release_dotnet.yml` | OIDC token exchanged for NuGet API key via nuget.org token endpoint | Release Artifacts | ### PyPI | Repository | Workflow | Auth Method | Category | |------------|----------|------------|----------| | airflow-publish | `airflow-publish.yml` | OIDC trusted publishing (id-token: write) | Release Artifacts | | airflow-publish | `providers-publish.yml` | OIDC trusted publishing (id-token: write) | Release Artifacts | | airflow-publish | `test-pypi-airflow-publish.yml` | OIDC trusted publishing (id-token: write) | Release Artifacts | | airflow-publish | `test-pypi-providers-publish.yml` | OIDC trusted publishing (id-token: write) | Snapshot / Nightly Artifacts | | fory | `release-compiler.yaml` | OIDC (id-token: write with pypa/gh-action-pypi-publish trusted publisher) | Release Artifacts | | fory | `release-python.yaml` | OIDC (id-token: write with pypa/gh-action-pypi-publish trusted publisher) | Release Artifacts | | hamilton | `contrib-auto-build-publish.yml` | OIDC trusted publishing (id-token: write permission, no API token required) | Release Artifacts | | iceberg-python | `nightly-pypi-build.yml` | OIDC trusted publishing (id-token: write) | Snapshot / Nightly Artifacts | | iceberg-rust | `publish.yml` | OIDC trusted publishing (id-token: write) for both crates.io and PyPI | Release Artifacts | | iceberg-rust | `release_python.yml` | OIDC trusted publishing (id-token: write) | Release Artifacts | | iceberg-rust | `release_python_nightly.yml` | OIDC trusted publishing (id-token: write) | Snapshot / Nightly Artifacts | | incubator-graphar | `python-wheel-workflow.yml` | OIDC (id-token: write) | Snapshot / Nightly Artifacts | | mahout | `release.yml` | OIDC (id-token: write, trusted publisher via pypa/gh-action-pypi-publish) | Release Artifacts | | opendal | `release_python.yml` | OIDC trusted publishing (id-token: write) | Release Artifacts | | otava-playground | `publish.yml` | OIDC trusted publishing (id-token: write) | Release Artifacts | | polaris | `nightly.yml` | OIDC trusted publishing (id-token: write) for PyPI; username/password secrets (NEXUS_USER, NEXUS_PW) for Apache Nexus | Snapshot / Nightly Artifacts | | polaris | `release-3-build-and-publish-artifacts.yml` | GPG key (crazy-max/ghaction-import-gpg), Nexus credentials via env vars (ORG_GRADLE_PROJECT_apacheUsername/apachePassword), SVN credentials via env vars (SVN_USERNAME/SVN_PASSWORD), PyPI OIDC Trusted Publishing (id-token: write) | Release Artifacts | | polaris | `release-4-publish-release.yml` | DOCKERHUB_TOKEN secret for Docker Hub; NEXUS_STAGE_DEPLOYER_USER/PW secrets for Maven Central/Nexus; OIDC trusted publishing (id-token: write) for PyPI; GITHUB_TOKEN for GitHub releases; SVN credentials for Apache dist | Release Artifacts | | sedona | `python-wheel.yml` | OIDC Trusted Publishing (id-token: write) | Release Artifacts | | sedona-spatialbench | `spatialbench-cli-publish-pypi.yml` | OIDC trusted publishing (id-token: write) | Release Artifacts | | thrift | `pypi.yml` | OIDC trusted publishing (id-token: write permission, no secrets required) | Release Artifacts | | tooling-asf-example | `release-on-tag.yaml` | OIDC Trusted Publisher (id-token: write) for PyPI; github.token for GitHub Releases | Release Artifacts | | tvm | `publish_wheel.yml` | OIDC (id-token: write) | Release Artifacts | | tvm-ffi | `publish_orcjit_wheel.yml` | OIDC (id-token: write) | Release Artifacts | | tvm-ffi | `publish_wheel.yml` | OIDC (id-token: write) | Release Artifacts | | tvm-ffi | `torch_c_dlpack.yml` | OIDC (id-token: write) | Release Artifacts | ### RubyGems | Repository | Workflow | Auth Method | Category | |------------|----------|------------|----------| | opendal | `release_ruby.yml` | OIDC (id-token: write permission for trusted publishing via rubygems/release-gem action) | Release Artifacts | | thrift | `release_ruby.yml` | id-token (OIDC) via rubygems/release-gem action with id-token: write permission | Release Artifacts | ## Trusted Publishing Migration Opportunities These workflows publish to ecosystems that support OIDC Trusted Publishing but currently use long-lived API tokens or passwords. Migrating to Trusted Publishing eliminates stored secrets and reduces supply-chain risk. ### crates.io **Available mechanism:** OIDC Trusted Publishing **Documentation:** https://doc.rust-lang.org/cargo/reference/registry-authentication.html | Repository | Workflow | Current Auth | Category | |------------|----------|-------------|----------| | casbin-actix-casbin-auth | `release.yml` | secrets.CARGO_TOKEN for crates.io; secrets.GITHUB_TOKEN for GitHub Release | Release Artifacts | | casbin-axum-casbin | `release.yml` | secrets.CARGO_TOKEN for crates.io; secrets.GITHUB_TOKEN for GitHub Release | Release Artifacts | | casbin-rs | `release.yml` | secrets.CARGO_TOKEN passed as cargo-registry-token to reusable workflow | Release Artifacts | | casbin-rust-actix-casbin | `release.yml` | secrets.CARGO_TOKEN for crates.io, secrets.GITHUB_TOKEN for GitHub Release | Release Artifacts | | casbin-rust-diesel-adapter | `release.yml` | secrets.CARGO_TOKEN for crates.io, secrets.GITHUB_TOKEN for GitHub Release | Release Artifacts | | casbin-rust-dufs-with-casbin | `release.yaml` | secrets.GITHUB_TOKEN, secrets.DOCKERHUB_USERNAME, secrets.DOCKERHUB_TOKEN, secrets.CRATES_IO_API_TOKEN | Release Artifacts | | casbin-rust-postgres-adapter | `release.yml` | CARGO_TOKEN secret for crates.io; GITHUB_TOKEN for GitHub Release | Release Artifacts | | casbin-rust-redis-watcher | `release.yml` | secrets.CARGO_TOKEN passed as cargo-registry-token to reusable workflow | Release Artifacts | | casbin-rust-rocket-authz | `release.yml` | secrets.CARGO_TOKEN for crates.io; secrets.GITHUB_TOKEN for GitHub Release | Release Artifacts | | casbin-rust-semantic-release-action-rust | `release-binary.yml` | cargo-registry-token secret passed to semantic-release action | Release Artifacts | | casbin-rust-semantic-release-action-rust | `release-library.yml` | cargo-registry-token secret passed to composite action | Release Artifacts | | casbin-rust-string-adapter | `release.yml` | secrets.CARGO_TOKEN for crates.io; secrets.GITHUB_TOKEN for GitHub Release | Release Artifacts | | casbin-rust-yaml-adapter | `release.yml` | secrets.CARGO_TOKEN for crates.io, secrets.GITHUB_TOKEN for GitHub Release | Release Artifacts | | casbin-sqlx-adapter | `release.yml` | CARGO_TOKEN secret for crates.io; GITHUB_TOKEN for GitHub Releases | Release Artifacts | | fluss-rust | `release_rust.yml` | CARGO_REGISTRY_TOKEN secret passed via env block | Release Artifacts | | hudi-rs | `release.yml` | CARGO_REGISTRY_TOKEN secret for crates.io; MATURIN_PYPI_TOKEN secret for PyPI | Release Artifacts | | iggy | `_publish_rust_crates.yml` | CARGO_REGISTRY_TOKEN secret set as env var on job | Release Artifacts | | iggy | `post-merge.yml` | secrets: inherit (passed to reusable publish.yml workflow) | Snapshot / Nightly Artifacts | | iggy | `publish.yml` | CARGO_REGISTRY_TOKEN (crates.io), DOCKERHUB_USER/DOCKERHUB_TOKEN (Docker Hub), PYPI_API_TOKEN (PyPI), NPM_TOKEN (npm), NEXUS_USER/NEXUS_PW (Maven/Nexus), JAVA_GPG_SIGNING_KEY/JAVA_GPG_PASSWORD (Java signing), NUGET_API_KEY (NuGet) | Release Artifacts | | opendal-ofs | `release.yml` | CARGO_REGISTRY_TOKEN secret for crates.io; GITHUB_TOKEN (implicit) for GitHub Releases | Release Artifacts | | opendal-oli | `release.yml` | CARGO_REGISTRY_TOKEN secret for crates.io; GITHUB_TOKEN (implicit) for GitHub Releases | Release Artifacts | | opendal-reqsign | `release.yml` | CARGO_REGISTRY_TOKEN set as environment variable via secrets | Release Artifacts | | paimon-full-text | `release-rust.yml` | CARGO_REGISTRY_TOKEN secret passed via env block | Release Artifacts | | paimon-mosaic | `release-rust.yml` | CARGO_REGISTRY_TOKEN secret passed via env block | Release Artifacts | | paimon-rust | `release-rust.yml` | CARGO_REGISTRY_TOKEN secret passed via env block | Release Artifacts | | paimon-vector-index | `release-rust.yml` | CARGO_REGISTRY_TOKEN secret passed via env block | Release Artifacts | | shenyu-client-rust | `publish.yml` | CARGO_REGISTRY_TOKEN secret passed via env block | Release Artifacts | | spark-connect-rust | `release.yml` | CARGO_REGISTRY_TOKEN secret passed via env block to action | Release Artifacts | ### npm **Available mechanism:** npm provenance with OIDC **Documentation:** https://docs.npmjs.com/generating-provenance-statements | Repository | Workflow | Current Auth | Category | |------------|----------|-------------|----------| | arrow-adbc | `packaging.yml` | ANACONDA_API_TOKEN secret, GEMFURY_API_TOKEN secret, GEMFURY_PUSH_TOKEN secret, GITHUB_TOKEN for releases | Snapshot / Nightly Artifacts | | casbin-casbin.js | `ci.yml` | NPM_TOKEN secret via env block | Release Artifacts | | casbin-core | `ci.yml` | NPM_TOKEN secret passed via env block | Release Artifacts | | casbin-js-vue-authz | `ci.yml` | NPM_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-node-casbin | `main.yml` | NPM_TOKEN secret passed via env block | Release Artifacts | | casbin-node-casbin-basic-adapter | `ci.yml` | NPM_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-node-casbin-etcd-watcher | `main.yml` | NPM_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-node-casbin-file-adapter | `ci.yml` | NPM_TOKEN secret via env block, GITHUB_TOKEN via env block | Release Artifacts | | casbin-node-casbin-mongo-changestream-watcher | `main.yml` | NPM_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-node-casbin-mongoose-adapter | `main.yml` | NPM_TOKEN secret for npm, GITHUB_TOKEN for GitHub releases | Release Artifacts | | casbin-node-casbin-node-redis-adapter | `release.yml` | NPM_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-node-casbin-redis-watcher | `ci.yml` | NPM_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-node-casbin-session-role-manager | `release.yml` | NPM_TOKEN secret via env block, GITHUB_TOKEN via env block | Release Artifacts | | casbin-sequelize-adapter | `ci.yml` | NPM_TOKEN and GITHUB_TOKEN via env block | Release Artifacts | | casbin-typeorm-adapter | `ci.yml` | NPM_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-vscode-plugin | `default.yml` | secrets.GITHUB_TOKEN, secrets.NPM_TOKEN, secrets.VS_MARKETPLACE_TOKEN | Release Artifacts | | casbin-website-v3 | `release.yml` | NPM_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | cordova-coho | `nightly.yml` | NODE_AUTH_TOKEN via secrets.CORDOVA_NPM_TOKEN passed through env block | Snapshot / Nightly Artifacts | | doris-cli | `release-npm.yml` | NODE_AUTH_TOKEN secret passed via env block to npm publish | Release Artifacts | | echarts | `nightly-next.yml` | NODE_AUTH_TOKEN via secrets.NPM_TOKEN passed through env block | Snapshot / Nightly Artifacts | | echarts | `nightly.yml` | NODE_AUTH_TOKEN via secrets.NPM_TOKEN passed through env block | Snapshot / Nightly Artifacts | | echarts-examples | `sync-nightly-mirror.yaml` | registry-url configured via actions/setup-node (NODE_AUTH_TOKEN expected) | Snapshot / Nightly Artifacts | | iggy | `post-merge.yml` | secrets: inherit (passed to reusable publish.yml workflow) | Snapshot / Nightly Artifacts | | iggy | `publish.yml` | CARGO_REGISTRY_TOKEN (crates.io), DOCKERHUB_USER/DOCKERHUB_TOKEN (Docker Hub), PYPI_API_TOKEN (PyPI), NPM_TOKEN (npm), NEXUS_USER/NEXUS_PW (Maven/Nexus), JAVA_GPG_SIGNING_KEY/JAVA_GPG_PASSWORD (Java signing), NUGET_API_KEY (NuGet) | Release Artifacts | | incubator-kie-tools | `publish_emscripten_fs.yml` | NPM_TOKEN written to ~/.npmrc | Release Artifacts | | incubator-resilientdb-ResContract | `npm-publish.yml` | NPM_AUTH_TOKEN secret via NODE_AUTH_TOKEN env var | Release Artifacts | | incubator-resilientdb-create-resilient-app | `main.yml` | NPM_TOKEN secret via NODE_AUTH_TOKEN environment variable | Release Artifacts | | incubator-resilientdb-resilient-node-cache | `main.yml` | NPM_TOKEN secret passed via NODE_AUTH_TOKEN environment variable | Release Artifacts | | incubator-resilientdb-resvault-sdk | `main.yml` | NPM_TOKEN secret via NODE_AUTH_TOKEN environment variable | Release Artifacts | | superset | `release.yml` | NPM_TOKEN secret written to .npmrc | Release Artifacts | ### NuGet **Available mechanism:** Sigstore-based Trusted Publishing **Documentation:** https://devblogs.microsoft.com/nuget/introducing-trusted-publishers/ | Repository | Workflow | Current Auth | Category | |------------|----------|-------------|----------| | casbin-Casbin.NET | `release.yml` | NUGET_API_KEY secret for nuget.org; GITHUB_TOKEN for GitHub Packages | Release Artifacts | | casbin-Casbin.NET-ef-adapter | `gitub-actions-build.yml` | MYGET_API_TOKEN secret passed via env block | Snapshot / Nightly Artifacts | | casbin-Casbin.NET-redis-adapter | `release.yml` | NUGET_API_KEY secret, MYGET_API_KEY secret, GITHUB_TOKEN | Release Artifacts | | casbin-Casbin.NET-redis-watcher | `build.yml` | API token via environment variable (MYGET_API_TOKEN from secrets) | Snapshot / Nightly Artifacts | | casbin-efcore-adapter | `release.yml` | NUGET_API_KEY secret for nuget.org; GITHUB_TOKEN for GitHub Packages | Release Artifacts | | iggy | `post-merge.yml` | secrets: inherit (passed to reusable publish.yml workflow) | Snapshot / Nightly Artifacts | | iggy | `publish.yml` | CARGO_REGISTRY_TOKEN (crates.io), DOCKERHUB_USER/DOCKERHUB_TOKEN (Docker Hub), PYPI_API_TOKEN (PyPI), NPM_TOKEN (npm), NEXUS_USER/NEXUS_PW (Maven/Nexus), JAVA_GPG_SIGNING_KEY/JAVA_GPG_PASSWORD (Java signing), NUGET_API_KEY (NuGet) | Release Artifacts | | lucenenet-codeanalysis-dev | `ci.yml` | secrets.NUGET_API_KEY for NuGet; secrets.GITHUB_TOKEN for GitHub Release | Release Artifacts | | pulsar-dotpulsar | `publish-to-nuget.yml` | secrets.NUGET_KEY passed via env block as NUGET_AUTH_TOKEN | Release Artifacts | ### PyPI **Available mechanism:** OIDC Trusted Publisher via pypa/gh-action-pypi-publish **Documentation:** https://docs.pypi.org/trusted-publishers/ | Repository | Workflow | Current Auth | Category | |------------|----------|-------------|----------| | arrow-adbc | `packaging.yml` | ANACONDA_API_TOKEN secret, GEMFURY_API_TOKEN secret, GEMFURY_PUSH_TOKEN secret, GITHUB_TOKEN for releases | Snapshot / Nightly Artifacts | | arrow-nanoarrow | `python-wheels.yaml` | NANOARROW_GEMFURY_TOKEN secret passed via env block | Snapshot / Nightly Artifacts | | beam | `deploy_release_candidate_pypi.yaml` | PyPI API token passed as workflow_dispatch input (PYPI_API_TOKEN) | Release Artifacts | | beam | `finalize_release.yml` | DOCKERHUB_USER/DOCKERHUB_TOKEN secrets for Docker Hub; PYPI_API_TOKEN workflow input for PyPI | Release Artifacts | | buildstream | `release.yml` | PyPI API token via secrets.PYPI_TOKEN; GitHub release via secrets.GITHUB_TOKEN | Release Artifacts | | casbin-dart-casbin | `dart.yml` | credentials.json stored as secret PUB_CREDENTIALS, GITHUB_TOKEN for semantic-release | Release Artifacts | | casbin-pycasbin | `build.yml` | PYPI_TOKEN secret (PYPI_TOKEN_CASBIN), GITHUB_TOKEN for GitHub releases | Release Artifacts | | casbin-python-async-django-orm-adapter | `build.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-async-sqlalchemy-adapter | `build.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-casbin-databases-adapter | `build.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-django-casbin-auth | `release.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-django-orm-adapter | `build.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-fastapi-casbin-auth | `release.yml` | PYPI_TOKEN secret for PyPI, GITHUB_TOKEN for GitHub releases | Release Artifacts | | casbin-python-graphql-authz | `build.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-postgresql-watcher | `release.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-pymongo-adapter | `main.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-rabbitmq-watcher | `build.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-redis-adapter | `build.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-sanic-authz | `build.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | casbin-python-sqlalchemy-adapter | `build.yml` | PYPI_TOKEN secret, GITHUB_TOKEN secret | Release Artifacts | | fluss | `python-release.yml` | API token via secrets.PYPI_API_TOKEN and secrets.TEST_PYPI_API_TOKEN passed through 'password' field of pypa/gh-action-pypi-publish action | Release Artifacts | | hudi-rs | `release.yml` | CARGO_REGISTRY_TOKEN secret for crates.io; MATURIN_PYPI_TOKEN secret for PyPI | Release Artifacts | | iggy | `post-merge.yml` | secrets: inherit (passed to reusable publish.yml workflow) | Snapshot / Nightly Artifacts | | iggy | `publish.yml` | CARGO_REGISTRY_TOKEN (crates.io), DOCKERHUB_USER/DOCKERHUB_TOKEN (Docker Hub), PYPI_API_TOKEN (PyPI), NPM_TOKEN (npm), NEXUS_USER/NEXUS_PW (Maven/Nexus), JAVA_GPG_SIGNING_KEY/JAVA_GPG_PASSWORD (Java signing), NUGET_API_KEY (NuGet) | Release Artifacts | | incubator-resilientdb-ResDB-ORM | `test-publish.yaml` | PyPI API token via secrets.PYPI_API_TOKEN passed to pypa/gh-action-pypi-publish | Release Artifacts | | incubator-resilientdb-resilient-python-cache | `main.yml` | PyPI API token via TWINE_PASSWORD environment variable | Release Artifacts | | paimon-full-text | `release-python-publish.yml` | API token via secrets (TEST_PYPI_API_TOKEN, PYPI_API_TOKEN) passed through with: password | Release Artifacts | | paimon-full-text | `release.yml` | secrets inherited by reusable workflows | Release Artifacts | | paimon-mosaic | `release-python-publish.yml` | API token via secrets (PYPI_API_TOKEN, TEST_PYPI_API_TOKEN) passed through with: block | Release Artifacts | | paimon-mosaic | `release.yml` | inherited secrets | Release Artifacts | | paimon-rust | `release_python_binding.yml` | API token via secrets.PYPI_API_TOKEN and secrets.TEST_PYPI_API_TOKEN passed through 'password' field of pypa/gh-action-pypi-publish action | Release Artifacts | | paimon-vector-index | `release-python-publish.yml` | API token via secrets (PYPI_API_TOKEN, TEST_PYPI_API_TOKEN) passed through with: block | Release Artifacts | | paimon-vector-index | `release.yml` | inherited secrets | Release Artifacts | | polaris-tools | `mcp-server-nightly.yml` | API token via UV_PUBLISH_TOKEN env var (secrets.TEST_PYPI_API_TOKEN) | Snapshot / Nightly Artifacts | | sdap-ingester | `github-dev-release.yml` | secrets.pypi_username / secrets.pypi_password for PyPI; secrets.GITHUB_TOKEN for snapshot release | Snapshot / Nightly Artifacts | | sdap-ingester | `pypi-tag-release.yml` | PyPI username/password via secrets | Release Artifacts | | sedona-db | `python-wheels.yml` | GEMFURY_PUSH_TOKEN secret passed via env block | Snapshot / Nightly Artifacts | | sedona-db | `wheels-expr.yml` | secrets.GEMFURY_PUSH_TOKEN via env block | Snapshot / Nightly Artifacts | | sedona-db | `wheels-zarr.yml` | secrets.GEMFURY_PUSH_TOKEN passed via env block | Snapshot / Nightly Artifacts | | singa | `conda.yaml` | ANACONDA_UPLOAD_TOKEN secret passed via env block | Release Artifacts | | spark | `release.yml` | secrets: ASF_USERNAME, ASF_PASSWORD, ASF_NEXUS_TOKEN, GPG_PRIVATE_KEY, GPG_PASSPHRASE, PYPI_API_TOKEN | Release Artifacts | | streampipes | `pypi-deployment.yml` | API token via secrets.PYPI_TOKEN passed to pypa/gh-action-pypi-publish | Release Artifacts | ### RubyGems **Available mechanism:** OIDC Trusted Publisher **Documentation:** https://guides.rubygems.org/trusted-publishing/ | Repository | Workflow | Current Auth | Category | |------------|----------|-------------|----------| | casbin-lua-casbin | `release.yml` | LUAROCKS_API_KEY secret | Release Artifacts | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
