PyPI added support for “Trusted Publishing” last year, allowing package maintainers to create releases directly from their GitHub Actions pipelines without having to worry about token management. Trusted Publishing removes long-lived API tokens from the equation, removing a threat vector for supply chain attacks.
In this talk, we’ll go through the details of how this works, how maintainers can easily take advantage of it with minimal changes to their existing setup, and the ongoing effort in the last 12 months to add support for publishers other than GitHub, such as GitLab, Google, and ActiveState.