-
[OPIK-7265] [CI] feat(release): publish opik-optimizer via PyPI Trusted Publishing (#7653)
frostbyte_neo 发布于
2026-07-28 14:33:55 +00:00 Switches the optimizer publish off the long-lived PYPI_API_TOKEN and onto
OIDC, matching what comet-python-mpm-sdk already does (#110):- permissions: add id-token: write so the runner can mint the short-lived
OIDC token PyPI trusts; drop packages: write (GitHub Packages, unused here) - remove the explicit password: input. An explicit password disables Trusted
Publishing outright — the failed run logged exactly that, alongside a
warning that it also voids attestations - remove the PyPI token preflight step. Per OPIK-7265 these checks exist only
to validate a stored token, and there is no longer one. It was also a no-op:
PyPI answers its bodyless POST probe with 405, which falls through to the
action's "continue anyway" branch, so it passed on every release regardless
and green-lit run 30353461156 seconds before that run 403'd
Why now: the token is scoped to the opik project and not opik-optimizer, so
uploads have failed with 403 since February. Trusted Publisher for
comet-ml/opik + opik-optimizer-publish.yml (Environment: Any) is now
registered on the PyPI project, so OIDC is ready to use.Unblocks the 3.1.1 release, and with it OPIK-7460 and OPIK-7461.
Co-authored-by: Claude Opus 5 (1M context) noreply@anthropic.com
下载附件
- permissions: add id-token: write so the runner can mint the short-lived