Skip to content

Support Gitlab CI/CD as a trusted publisher #12754

@jamesharr

Description

@jamesharr

Summary

This Issue is a feature request to add Gitlab-CI/CD support as a trusted publisher when working with PyPI repositories.

PyPI has Support for Gitlab-CI/CD as a trusted publisher (2) and UV includes support for Github-Actions as a trusted publisher, so I suspect adding Gitlab-CI/CD support would be small incremental work.

It's possible that UV might already support this and the only thing required is additional documentation to get the environment variables set correctly. I did not have any luck in making it work on my own after reading UV's documentation. It's not entirely clear to me as to what underlying tools UV makes use of to do python publishing (I heard Twine mentioned in the Discord community), so my expectation as a user is that the UV docs would include an example+instructions OR link to the documentation of the underlying tool that does the publishing.

During my attempt setting it up, I wound up finding a [blog post (2)] 1 detailing some steps to make it work, however there is some work that needs to be done outside UV to exchange an OAuth2 token for a PyPI JWT token that can be passed in via the CLI.

Example from the blog post (1):

.release-base:
  stage: 'deploy'
  id_tokens:
    PYPI_ID_TOKEN:
      aud: '$PYPI_OIDC_AUD'
  script:
    - >-
      resp="$(curl -X POST "${PYPI_OIDC_URL}" -d "{\"token\":\"${PYPI_ID_TOKEN}\"}")"
    - >-
      publish_token="$(python -c "import json; print(json.load('${resp}')['token'])")"
    - 'uv publish --token "$publish_token"'

release:
  extends: '.release-base'
  rules:
    - if: '$CI_COMMIT_TAG'
  environment:
    name: 'release'
    url: 'https://pypi.org/project/typed-settings/'
  variables:
    PYPI_OIDC_AUD: 'pypi'
    PYPI_OIDC_URL: 'https://pypi.org/_/oidc/mint-token'
    UV_PUBLISH_URL: 'https://upload.pypi.org/legacy/'

References:

  1. Publishing to PyPI with a Trusted Publisher from GitLab CI/CD - Stefan Scherfke blog post
  2. Publishing with a Trusted Publisher - PyPI Docs
  3. Publishing your package - UV Documentation
  4. Using uv in GitLab Ci/CD - UV Documentation

Example

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or improvement to existing functionality

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions