How to publish to PyPI using GitHub Actions securely

2 months ago

Implement zizmor to analyze and secure GitHub Actions workflows by fixing insecure defaults and adding it to CI.
Use Trusted Publishing for PyPI to avoid managing API tokens and leverage GitHub's security.
Require approval for publishing workflows via GitHub environments to prevent accidental or malicious releases.

Hasty Briefsbeta