From 6b1c9fbe67e2ab3b6314714cfbcc7e3168c0e717 Mon Sep 17 00:00:00 2001
From: Fernando Alonso <fernandoalonso@xwf.google.com>
Date: Thu, 29 Oct 2026 02:27:23 +0000
Subject: [PATCH] ci(release): migrate PyPI publishing to OSS Exit Gate

---
 .github/workflows/release.yml | 48 ++++++++++++++++++++++-------------
 1 file changed, 31 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a590d03..3adbd47 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,26 +4,40 @@ on:
   release:
     types: [published]
 
+permissions: {}
+
 jobs:
- build-and-publish:
+  build-and-publish:
     name: Build and Publish
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
     steps:
-    - name: Checkout
-      uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e
-      with:
-        ref: ${{ github.event.release.tag_name }}
-        persist-credentials: false
-    - name: Install Python
-      uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e
-    - name: Install build dependencies
-      run: python -m pip install -U setuptools build wheel
-    - name: Build distributions
-      run: python -m build
-    - name: Publish
-      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33
-      with:
-        user: __token__
-        password: ${{ secrets.PYPI_API_TOKEN }}
+      - name: Checkout
+        uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e
+        with:
+          ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
+      - name: Install Python
+        uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e
+      - name: Install build dependencies
+        run: python -m pip install -U setuptools build wheel twine
+      - name: Build distributions
+        run: python -m build
+      - name: Authenticate to Google Cloud (OSS Exit Gate)
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed
+        with:
+          workload_identity_provider: 'projects/305452601764/locations/global/workloadIdentityPools/builders/providers/github'
+      - name: Set up Cloud SDK
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f
+      - name: Stage to OSS Exit Gate and upload manifest
+        run: |
+          python -m twine upload \
+            --repository-url "https://us-python.pkg.dev/oss-exit-gate-prod/appengine-python--pypi/" \
+            -u oauth2accesstoken \
+            -p "$(gcloud auth print-access-token)" \
+            dist/*
+          echo '{"publish_all": true}' > manifest.json
+          gcloud storage cp manifest.json \
+            "gs://oss-exit-gate-prod-projects-bucket/appengine-python/pypi/manifests/manifest-${{ github.run_id }}-${{ github.run_attempt }}.json"