From ea2b4658fb0c495ebb9a363b9b8d3b97a51bc6cf Mon Sep 17 00:00:00 2001 From: jw9829 <245427686+jw9829@users.noreply.github.com> Date: Sun, 27 Sep 2026 14:22:45 -0400 Subject: [PATCH 1/3] Recommend Trusted Publishing in tutorial --- source/tutorials/packaging-projects.rst | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/source/tutorials/packaging-projects.rst b/source/tutorials/packaging-projects.rst index fe6d6f4f24..924fe22095 100644 --- a/source/tutorials/packaging-projects.rst +++ b/source/tutorials/packaging-projects.rst @@ -495,15 +495,19 @@ When you are ready to upload a real package to the Python Package Index you can do much the same as you did in this tutorial, but with these important differences: +For projects published through a supported CI/CD platform, we recommend +:ref:`Trusted Publishing ` instead of storing a long-lived +API token. The linked guide shows how to set this up with GitHub Actions. + * Choose a memorable and unique name for your package. You don't have to append your username as you did in the tutorial, but you can't use an existing name. * Register an account on https://pypi.org - note that these are two separate servers and the login details from the test server are not shared with the main server. -* Use ``twine upload dist/*`` to upload your package and enter your credentials - for the account you registered on the real PyPI. Now that you're uploading - the package in production, you don't need to specify ``--repository``; the - package will upload to https://pypi.org/ by default. +* For a manual upload, use ``twine upload dist/*`` to upload your package and + enter your credentials for the account you registered on the real PyPI. Now + that you're uploading the package in production, you don't need to specify + ``--repository``; the package will upload to https://pypi.org/ by default. * Install your package from the real PyPI using ``python3 -m pip install [your-package]``. At this point if you want to read more on packaging Python libraries here are From ee749592f4f32cb7279b9b895c037684f90e810c Mon Sep 17 00:00:00 2001 From: jw9829 <245427686+jw9829@users.noreply.github.com> Date: Sun, 27 Sep 2026 20:22:36 -0400 Subject: [PATCH 2/3] Move Trusted Publishing note into a tip --- source/tutorials/packaging-projects.rst | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/source/tutorials/packaging-projects.rst b/source/tutorials/packaging-projects.rst index 924fe22095..4d08cc79a9 100644 --- a/source/tutorials/packaging-projects.rst +++ b/source/tutorials/packaging-projects.rst @@ -495,10 +495,6 @@ When you are ready to upload a real package to the Python Package Index you can do much the same as you did in this tutorial, but with these important differences: -For projects published through a supported CI/CD platform, we recommend -:ref:`Trusted Publishing ` instead of storing a long-lived -API token. The linked guide shows how to set this up with GitHub Actions. - * Choose a memorable and unique name for your package. You don't have to append your username as you did in the tutorial, but you can't use an existing name. * Register an account on https://pypi.org - note that these are two separate @@ -510,6 +506,12 @@ API token. The linked guide shows how to set this up with GitHub Actions. ``--repository``; the package will upload to https://pypi.org/ by default. * Install your package from the real PyPI using ``python3 -m pip install [your-package]``. +.. tip:: + + For projects published through a supported CI/CD platform, we recommend + :ref:`Trusted Publishing ` instead of storing a long-lived + API token. The linked guide shows how to set this up with GitHub Actions. + At this point if you want to read more on packaging Python libraries here are some things you can do: From d350151abb5fa6e5d114dcc4a057f8a3f9f69984 Mon Sep 17 00:00:00 2001 From: jw9829 <245427686+jw9829@users.noreply.github.com> Date: Tue, 29 Sep 2026 21:49:36 -0400 Subject: [PATCH 3/3] Move trusted publishing tip before upload steps --- source/tutorials/packaging-projects.rst | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/source/tutorials/packaging-projects.rst b/source/tutorials/packaging-projects.rst index 4d08cc79a9..4195b5e947 100644 --- a/source/tutorials/packaging-projects.rst +++ b/source/tutorials/packaging-projects.rst @@ -491,6 +491,12 @@ PyPI, which isn't a permanent storage. The Test system occasionally deletes packages and accounts. It is best to use TestPyPI for testing and experiments like this tutorial. +.. tip:: + + For projects published through a supported CI/CD platform, we recommend + :ref:`Trusted Publishing ` instead of storing a long-lived + API token. The linked guide shows how to set this up with GitHub Actions. + When you are ready to upload a real package to the Python Package Index you can do much the same as you did in this tutorial, but with these important differences: @@ -506,12 +512,6 @@ differences: ``--repository``; the package will upload to https://pypi.org/ by default. * Install your package from the real PyPI using ``python3 -m pip install [your-package]``. -.. tip:: - - For projects published through a supported CI/CD platform, we recommend - :ref:`Trusted Publishing ` instead of storing a long-lived - API token. The linked guide shows how to set this up with GitHub Actions. - At this point if you want to read more on packaging Python libraries here are some things you can do: