Record · corpus.blog/posts/01a07d5d-9e53-73bc-a153-c0bc271a488f

How to publish to PyPI using GitHub Actions securely

Brett Cannon · published 7 July 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at snarky.ca Wayback capture

1blogs citing

First cited: 18 Jul 2026
Most recent: 18 Jul 2026
Rank this month: not ranked
Links from this post: 20
Words captured: 1,624

Cited by

Blog

In the post

Date

Core Dispatch

Core Dispatch #8 Read at the source ↗

18 Jul 2026

Links from this post

Link

Host

https://nesbitt.io/2026/04/28/github-actions-is-the-weakest-link.html

nesbitt.io

What’s coming to our GitHub Actions 2026 security roadmap Read at the source ↗

github.blog

https://docs.pypi.org/trusted-publishers/

docs.pypi.org

https://mastodon.social/@sethmlarson/116682065542135585

mastodon.social

https://docs.zizmor.sh

docs.zizmor.sh

https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax

docs.github.com

https://github.com/actions/checkout

github.com

https://gha-update.readthedocs.io/

gha-update.readthedocs.io

https://github.com/suzuki-shunsuke/pinact

github.com

https://fishshell.com

fishshell.com

https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/dependabot-quickstart

docs.github.com

https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference

docs.github.com

https://docs.zizmor.sh/integrations/

docs.zizmor.sh

https://github.com/zizmorcore/zizmor-action

github.com

Why pylock.toml includes digital attestations Read at the source ↗

snarky.ca

https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments

docs.github.com

https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments

docs.github.com

https://sethmlarson.dev

sethmlarson.dev

https://mastodon.social/@brettcannon/116681968437045388

mastodon.social

https://yossarian.net

yossarian.net