PyPI Buildkite OIDC support

Note

This is not yet generally available, but work is in progress.

Securely push Python packages from your Buildkite pipelines. Exchanges a Buildkite OIDC token as a trusted publisher on PyPI, the Python Package Index. Exports TWINE_USERNAME and TWINE_PASSWORD for use by Twine.

steps:
- label: ":python: Build and push to PyPI"
  plugins:
  - sj26/pypi-oidc
  command: |
    python3 setup.py sdist
    python3 -m pip install --upgrade twine
    twine upload dist/*

Requirements

Python 3 supported versions, and the standard library. No packages are used outside the standard library.

Thanks

Inspired by https://github.com/pypa/gh-action-pypi-publish, and with generous guidance by William Woodruff.