move publish job to trusted publishing#1847
Merged
Merged
Conversation
xavdid
requested review from
jar-stripe and
kidus-stripe
and removed request for
a team and
kidus-stripe
July 13, 2026 21:00
xavdid
added a commit
that referenced
this pull request
Jul 17, 2026
* Update generated code (#1836) * Update generated code for v2323 and 1f0a7866ce5b5e12153c09a04349f91486b17d95 * Update generated code for v2324 and 6012b623b1c09ad54d466947da04511a042ee45a --------- Co-authored-by: Stripe OpenAPI <105521251+stripe-openapi[bot]@users.noreply.github.com> * Bump version to 15.3.0 * Reduce StripeClient() cold start latency for serverless environments (#1834) * Remove unused Retry-After header support (#1843) * make api error fields generated (#1845) * move publish job to trusted publishing (#1847) * move to trusted publishing * Replace source hash with Telemetry UUID (#1846) * Replace source hash with telemetry UUID * minor tweaks * Add/adjust tests & CI * Bump version to 15.3.1 * use ip address directly instead of localhost for faster windows tests (#1849) --------- Co-authored-by: stripe-openapi[bot] <105521251+stripe-openapi[bot]@users.noreply.github.com> Co-authored-by: jar-stripe <jar@stripe.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
Our current release process uses a long-lived PyPI token to upload releases. While still supported, it's no longer the favored way to do Python releases because if that token leaks, attackers can publish your package.
The current best practice is "trusted publishing", where github communicates with PyPI to mint a short-lived token with publishing permissions on demand. We start a release, get a token, use that token for the release, then revoke it.
The process is straightforward. We make these changes to our CI (using the official GH action for python publishing) and then log into PyPI and hit a checkbox to enable the feature. After that, publishing will work like it always had and we'll be able to delete the
TWINE_PASSWORDsecret.What?
environmentandid-tokenSee Also