Trusted Publishing

[johannschopplich]

Hey @toon-format/python-maintainers, I've finished setting up the automated publishing for the toon-python package. Here's what's configured:

PyPI Setup

Production (pypi.org)

• Set up trusted publisher for toon_format
• Connected to our publish.yml workflow
• Uses the pypi environment
• No API tokens needed - using OIDC authentication

TestPyPI (test.pypi.org)

• Created a separate account (didn't know this was needed!)
• Same trusted publisher setup as production
• Uses the testpypi environment
• Good for testing releases before they go live

GitHub Configuration

Created two environments in the repo settings:

• pypi - for production releases
• testpypi - for test releases

The CI workflows someone already set up are working with this:

• Lint workflow - runs ruff and mypy checks
• Test workflow - tests across Python 3.8-3.12 with coverage requirements
• Publish workflow - handles the actual PyPI publishing

How Releases Work

Publishing is automated:

• Create a GitHub release → automatically publishes to PyPI
• Manually trigger the workflow → publishes to TestPyPI for testing

Note

Please decide jointly when to release. Also, my preferred release workflow is usually to create a tag and let the GitHub release action create the GitHub release automatically. Semantic commits as a base for the generate changelog. Maybe something for the future. :)

The trusted publishing setup means we don't have to manage any API tokens or secrets. Everything happens securely through GitHub's OIDC.

That should enable you to release whenever you are ready. 🚀

[davidpirogov]

Fantastic, thank you @johannschopplich

We need to follow Python semver format so we work well with existing toolchains.

Our version 1.0.0 needs to be compliance to spec, so let’s test some releases with a -beta version set to make sure the publishing is working.

I hope that our release schedule will slow down once we’re at spec compliance and we’ll need minor updates.

Versioning wise, I’m proposing:

0.8.x - initial code set, code tests, documentation and migration of missing stuff from toon-llm
0.9.x - serializer, spec compliance, publishing to pypi (test and prod)
1.0.0-rc.x - production readiness
1.0.0 - 🎉

should we use the GitHub milestones for this?

[Justar96]

this sound!!