Introducing trusted publishing

[ingyhere]

Purpose

• Implement PEP-740 Trusted Publishing to PyPi

Proposed Changes

• Update python-publish.yml in GH Workflows directory to implement a staged trusted publishing algorithm as implemented by the PyPi Warehouse. This PEP-740-compliant SLIM implementation stages publishing to allow integrity checks tied to packaging builds with separate, repository pushes. This is forward compatible and flexible for implementers to push to multiple destinations.

Issues

• Python Starter Kit: Trusted publishing slim#167

Testing

• Tested publishing to PyPi on multiple releases with the NASA EXOTIC OSS project

[nutjob4life]

Oh wow, trusted publishing! I was wondering how this worked. Didn't realize there was an action pypa/gh-action-pypi-publish that did it.

[thomas-bc]

We have migrated to trusted publishing on F Prime a couple months ago and it is really neat!

See
https://github.com/nasa/fprime-tools/blob/devel/.github/workflows/publish.yml
https://github.com/nasa/fprime-gds/blob/devel/.github/workflows/publish.yml

[nutjob4life]

@ingyhere I noticed that this PR is in the "Draft" state; is it ready for review?

[ingyhere]

De-scoped to focus solely on Trusted Publishing. ...

[ingyhere]

@thomas-bc wrote:

We have migrated to trusted publishing on F Prime a couple months ago and it is really neat!

Thank you. That looks fantastic, and I appreciate how it is drop-in.

In this iteration here the attempt was to make the GH Action flexible enough so that it could release on multiple repositories with some tweaking. Additionally, the id-token perms are limited to the publishing phase.

[ingyhere]

@nutjob4life wrote:

I noticed that this PR is in the "Draft" state ...
Ready now for review. Thanks.

[ingyhere]

These look correct as intended.

[nutjob4life]

Looks good!