fix(publish-runtime): use PyPI Trusted Publisher (OIDC) instead of PYPI_TOKEN - #2113
Merged
Merged
Conversation
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Apr 26, 2026
Reflects PR #2113 (PyPI Trusted Publisher / OIDC migration). No static PyPI token exists in the repo anymore, so the docs shouldn't claim one does. Replaces the PYPI_TOKEN row in the Required Secrets table with an "Auth" section pointing at the OIDC config; TEMPLATE_DISPATCH_TOKEN is still the only repo secret the cascade needs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…PI_TOKEN Drops the static PYPI_TOKEN secret in favor of OIDC trusted publishing. PyPI now mints a short-lived upload credential after verifying the workflow's OIDC claim against the trusted-publisher config registered for molecule-ai-workspace-runtime (Molecule-AI/molecule-core, publish-runtime.yml, environment pypi-publish). Why: - A leaked PYPI_TOKEN would let any holder publish arbitrary versions of molecule-ai-workspace-runtime to PyPI from anywhere — bypassing the monorepo's review and CI gates entirely. The 8 template repos pull this package; a malicious publish poisons all of them. - Trusted Publisher (OIDC) makes that exfil path moot: no long-lived credential exists to leak. Only this exact workflow, on this repo, in the pypi-publish environment, can upload. After this lands and the first OIDC publish succeeds, the PYPI_TOKEN repo secret should be deleted (it becomes dead weight + a leak surface with no purpose). Belt-and-suspenders companion to PR #56 in molecule-ai-workspace-runtime (sibling repo lockdown). Without OIDC, the sibling lockdown alone doesn't prevent local `python -m build && twine upload` from a laptop with a personal PyPI maintainer credential. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
force-pushed
the
fix/publish-runtime-oidc
branch
from
April 26, 2026 20:14
cc4f31c to
2e050df
Compare
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Apr 26, 2026
Reflects PR #2113 (PyPI Trusted Publisher / OIDC migration). No static PyPI token exists in the repo anymore, so the docs shouldn't claim one does. Replaces the PYPI_TOKEN row in the Required Secrets table with an "Auth" section pointing at the OIDC config; TEMPLATE_DISPATCH_TOKEN is still the only repo secret the cascade needs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
added a commit
that referenced
this pull request
Apr 26, 2026
) * docs: point new-runtime-template flow at the GitHub template repo The 'Writing a new adapter' section was a 6-step manual checklist that re-derived the canonical shape every time. Now that Molecule-AI/molecule-ai-workspace-template-starter exists as a GitHub template, the flow collapses to: gh repo create ... --template Molecule-AI/molecule-ai-workspace-template-starter Plus a fill-in-the-TODO-markers table. Why this matters: the starter ships with the 'repository_dispatch: [runtime-published]' cascade receiver pre-wired, which means new templates pick up runtime PyPI publishes automatically without the one-time setup PR each existing template needed (PRs #6-#22 across the 8 template repos that we just opened to retrofit). At 'hundreds of runtimes' scale this is the difference between linear PR- toil and zero PR-toil per template addition. Also adds: 'When the starter itself needs to evolve' — explicit pattern for keeping the canonical shape in one place when it changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) * docs(workspace-runtime): drop PYPI_TOKEN refs — OIDC is the new auth Reflects PR #2113 (PyPI Trusted Publisher / OIDC migration). No static PyPI token exists in the repo anymore, so the docs shouldn't claim one does. Replaces the PYPI_TOKEN row in the Required Secrets table with an "Auth" section pointing at the OIDC config; TEMPLATE_DISPATCH_TOKEN is still the only repo secret the cascade needs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Hongming Wang <hongmingwangalt@gmail.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
These 5 workflows have been stable since the 2026-05-11 Gitea port: - block-internal-paths - check-migration-collisions - lint-bp-context-emit-match - lint-curl-status-capture - lint-required-context-exists-in-bp All are well past the 7-clean-run/7-clean-day Phase 3 threshold. Phase 4 flip per RFC internal#219 §1. Fixes #2113 (partial — remaining ~27 masks still in flight).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
publish-runtime.ymlfrom twine +PYPI_TOKENto PyPI Trusted Publisher (OIDC)id-token: writepermission on thepublishjob (least-privilege;cascadejob unchanged)Why
A leaked
PYPI_TOKENwould let any holder publish arbitrary versions ofmolecule-ai-workspace-runtimeto PyPI from anywhere — bypassing the monorepo's review and CI gates entirely. The 8 workspace template repos pull this package, so a malicious publish poisons all of them.Trusted Publisher (OIDC) eliminates that exfil path: no long-lived credential exists to leak. Only this exact workflow, on this repo, in the
pypi-publishenvironment, can upload.This is the belt-and-suspenders companion to the sibling-repo lockdown PR (PR #56 in
molecule-ai-workspace-runtime) — without OIDC, the sibling lockdown alone doesn't prevent a local `python -m build && twine upload` from a laptop with a personal PyPI maintainer credential.PyPI side (already done)
Trusted Publisher is configured at https://pypi.org/manage/project/molecule-ai-workspace-runtime/settings/publishing/ pointing at:
Molecule-AI/molecule-corepublish-runtime.ymlpypi-publishAfter this merges
workflow_dispatchofpublish-runtimewith a dev version (e.g. `0.1.6.dev1`) to confirm OIDC end-to-endTest plan
workflow_dispatchwithversion: 0.1.6.dev1(or similar) succeeds and the version appears on PyPIPYPI_TOKENsecret is no longer referenced anywhere in the repo (`gh secret list` + `grep -r PYPI_TOKEN .github/`)Notes
🤖 Generated with Claude Code