From 5695e17023aed4fa3fcc68764cddb7b1e107e75c Mon Sep 17 00:00:00 2001
From: Carlo Goetz <carlo.goetz@inovex.de>
Date: Wed, 4 Nov 2026 17:00:15 +0100
Subject: [PATCH] chore(pypi): use trusted publishing

---
 .github/workflows/cd.yaml |  5 +++--
 RELEASE.md                | 15 ++++++++++++++-
 scripts/cd.sh             |  2 +-
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml
index ce302bfdb..77dbee4a9 100644
--- a/.github/workflows/cd.yaml
+++ b/.github/workflows/cd.yaml
@@ -8,9 +8,11 @@ on:
 jobs:
   check-version:
     runs-on: ubuntu-latest
-    permissions: 
+    environment: pypi
+    permissions:
       pull-requests: write
       contents: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -24,7 +26,6 @@ jobs:
       - name: Push tag for each updated package
         env:
           GH_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
-          PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
         run: |
           git config --global user.name "SDK Releaser Bot"
           git config --global user.email "noreply@stackit.de"
diff --git a/RELEASE.md b/RELEASE.md
index c913eab4e..fbb3afb71 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -4,6 +4,20 @@
 
 A release of the whole SDK should be created at least every 2 weeks. 
 
+## PyPI trusted publishing setup
+
+The [CD workflow](.github/workflows/cd.yaml) publishes the core package and service
+packages with `uv publish --trusted-publishing always`. GitHub Actions OIDC is
+required; no long-lived PyPI token is used. Keep the workflow filename `cd.yaml`
+and the job's environment `pypi` in sync with the PyPI publisher configuration.
+
+The job grants `id-token: write` so uv can obtain short-lived publishing
+credentials. 
+
+References: [PyPI trusted publishers](https://docs.pypi.org/trusted-publishers/adding-a-publisher/),
+[uv publishing from GitHub Actions](https://docs.astral.sh/uv/guides/integration/github/#publishing-to-pypi),
+[GitHub environment options](https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments).
+
 ## Release creation
 
 ### Single service
@@ -38,4 +52,3 @@ The SDK is split into all the different STACKIT [services](https://github.com/st
 4. Copy the changelog entries for the new release from the `CHANGELOG.md` file in the root directory of the repository (see [here](https://github.com/stackitcloud/stackit-sdk-python/blob/608176ab8cdfa60a3cfb09da49de0b1aba5fea84/CHANGELOG.md)) to your clipboard.
 5. Go to the [releases page](https://github.com/stackitcloud/stackit-sdk-python/releases) on GitHub and create a new release. Select the git tag you just created.
 6. Before creating the GitHub release, add the *Highlights* heading at the top of the markdown description and paste the changelog entries from your clipboard (see [previous releases](https://github.com/stackitcloud/stackit-sdk-python/releases/tag/release-2025-03-27) to see what it should look like). Then create and publish the GitHub release.
-
diff --git a/scripts/cd.sh b/scripts/cd.sh
index a1cccbd7d..bc257bd2e 100755
--- a/scripts/cd.sh
+++ b/scripts/cd.sh
@@ -19,7 +19,7 @@ for file in $(find . -print | sed 's|^./||' | grep -E "(^services/[^/]+/pyprojec
         git push origin tag $expected_tag
         cd $dirpath
         uv build
-        uv publish --username="__token__" --password="$PYPI_TOKEN"
+        uv publish --trusted-publishing always
         cd $GITHUB_WORKSPACE
     fi              
 done