diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml index 4de7aec4f551a..36a48a61867f8 100644 --- a/.github/workflows/wheels.yml +++ b/.github/workflows/wheels.yml @@ -13,6 +13,8 @@ name: Wheel builder on: + release: + types: [published] schedule: # 3:27 UTC every day - cron: "27 3 * * *" @@ -219,3 +221,42 @@ jobs: source ci/upload_wheels.sh set_upload_vars upload_wheels + + publish: + if: > + github.repository == 'pandas-dev/pandas' && + github.event_name == 'release' && + startsWith(github.ref, 'refs/tags/v') + + needs: + - build_sdist + - build_wheels + + runs-on: ubuntu-latest + + environment: + name: pypi + permissions: + id-token: write # OIDC for Trusted Publishing + contents: read + + steps: + - name: Download all artefacts + uses: actions/download-artifact@v4 + with: + path: dist # everything lands in ./dist/** + + - name: Collect files + run: | + mkdir -p upload + # skip any wheel that contains 'pyodide' + find dist -name '*pyodide*.whl' -prune -o \ + -name '*.whl' -exec mv {} upload/ \; + find dist -name '*.tar.gz' -exec mv {} upload/ \; + + - name: Publish to **PyPI** (Trusted Publishing) + uses: pypa/gh-action-pypi-publish@release/v1 + with: + repository-url: https://upload.pypi.org/legacy/ + packages-dir: upload + skip-existing: true diff --git a/doc/source/development/maintaining.rst b/doc/source/development/maintaining.rst index c37925f7e271a..6462b9b194776 100644 --- a/doc/source/development/maintaining.rst +++ b/doc/source/development/maintaining.rst @@ -445,9 +445,10 @@ which will be triggered when the tag is pushed. - Set as the latest release: Leave checked, unless releasing a patch release for an older version (e.g. releasing 1.4.5 after 1.5 has been released) -5. Upload wheels to PyPI:: - - twine upload pandas/dist/pandas-*.{whl,tar.gz} --skip-existing +5. Verify wheels are uploaded automatically by GitHub Actions + via [**Trusted Publishing**](https://docs.pypi.org/trusted-publishers/) + when the GitHub [*Release*](https://docs.github.com/en/repositories/releasing-projects-on-github/about-releases) + is published. Do not run ``twine upload`` manually. 6. The GitHub release will after some hours trigger an `automated conda-forge PR `_. diff --git a/doc/source/whatsnew/v3.0.0.rst b/doc/source/whatsnew/v3.0.0.rst index 8d3ac0e396430..a449813cf098c 100644 --- a/doc/source/whatsnew/v3.0.0.rst +++ b/doc/source/whatsnew/v3.0.0.rst @@ -91,6 +91,7 @@ Other enhancements - Support passing a :class:`Iterable[Hashable]` input to :meth:`DataFrame.drop_duplicates` (:issue:`59237`) - Support reading Stata 102-format (Stata 1) dta files (:issue:`58978`) - Support reading Stata 110-format (Stata 7) dta files (:issue:`47176`) +- Switched wheel upload to **PyPI Trusted Publishing** (OIDC) for release-tag pushes in ``wheels.yml``. (:issue:`61718`) .. --------------------------------------------------------------------------- .. _whatsnew_300.notable_bug_fixes: