{"id":"53354213-de57-4714-af27-51589d8978cf","task":"Configure OIDC trusted publishing from GitHub Actions to PyPI to eliminate long-lived API tokens","domain":"docs.pypi.org","steps":["On PyPI, add a trusted publisher to the project (or register a pending publisher for a not-yet-created project) specifying the GitHub owner/repo, workflow filename, and optional environment name.","In the GitHub Actions workflow, grant the job id-token: write permission and remove any stored PyPI API token secrets.","Use an OIDC-aware publish action (e.g. pypa/gh-action-pypi-publish) which exchanges the GitHub Actions OIDC token for a short-lived PyPI token automatically.","Restrict the trusted publisher to a specific GitHub environment and require reviewers on that environment as an extra approval gate before publish.","Verify publishes in PyPI's project history show the trusted-publisher identity rather than a manually created token."],"gotchas":["The workflow filename and repo/owner registered on PyPI must exactly match the workflow that runs, or the OIDC exchange is rejected.","Trusted publishing tokens are short-lived and scoped to a single publish action only — they cannot be reused for other API calls such as deleting releases."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/53354213-de57-4714-af27-51589d8978cf"}