Merge pull request #129 from ithaka/feat/trusted-publishing

Enable trusted publishing

.github/workflows/main.yml

@@ -89,6 +89,8 @@ jobs:
     needs: [lint, test, typecheck, docs]
     if: startsWith(github.ref, 'refs/tags')
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v3
 
@@ -106,13 +108,10 @@ jobs:
       - name: Publish distribution to Test PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
-          password: ${{ secrets.TEST_PYPI_API_TOKEN }}
           repository_url: https://test.pypi.org/legacy/
 
       - name: Publish distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
 
       - name: Publish distribution to GitHub release
         uses: softprops/action-gh-release@v1

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [7.1.0-post.1] - 2023-04-24
+### Changed
+- Use PyPI trusted publishing instead of manual token authentication
+
 ## [7.1.0] - 2023-04-19
 ### Added
 - You can now configure `retry_spec` and `timeout_spec` at the endpoint level. Calls to endpoints may override the endpoint-level configuration when necessary.

setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = apiron
-version = 7.1.0
+version = 7.1.0-post.1
 description = apiron helps you cook a tasty client for RESTful APIs. Just don't wash it with SOAP.
 author = Ithaka Harbors, Inc.
 author_email = [email protected]