PyPI wants us to use trusted publishing

[pllim]

https://docs.pypi.org/trusted-publishers

[neutrinoceros]

As far as I understand, the blockers here are

• Supported PyPI trusted publishers OpenAstronomy/github-actions-workflows#136
• Trusted publishing: Support for GitHub reusable workflows pypi/warehouse#11096 (comment)

[neutrinoceros]

It would actually be trivial to resolve this issue by dropping OpenAstronomy's reusable workflows and switch to https://github.com/pypa/gh-action-pypi-publish

how controversial would that be ?

[astrofrog]

What is the benefit of doing it?

[neutrinoceros]

security. It makes supply chain attacks less likely by preventing anyone to steal a long-lived secret token and publish a malicious version of the package with stolen credentials.

[neutrinoceros]

Note that because the token is long-lived, it's possible for someone might steal it at one point and publish malicious code much later.

[astrofrog]

I need to check something about reusable workflows before I can comment more on this - more soon

[neutrinoceros]

It's now possible to use trusted-publishing without rewriting the entire infra: OpenAstronomy/github-actions-workflows#136 (comment)