Python (PyPI)

The Python target publishes to PyPI. The distribution name is the target's projectName (or packageName). See the Python configuration for naming options.

Authenticate the release with OIDC trusted publishing (the default, recommended) or a PyPI API token. PyPI accepts a pending trusted publisher for a project that does not exist yet, so even a brand-new SDK can publish its first version without a token.

Enable publishing

Turn on Publish to PyPI on merge, or add a publish block:

{
  "targets": {
    "python": {
      "packageName": "acme",
      "projectName": "acme-api",
      "publish": { "pypi": true }
    }
  }
}

Trusted publishing (OIDC)

Recommended. PyPI exchanges the workflow's identity token for a short-lived upload token, so no secret is stored.

Add a trusted publisher on PyPI

On pypi.org, add a GitHub publisher:

For a project that does not exist yet, add a pending publisher at pypi.org/manage/account/publishing. It also asks for the PyPI project name to reserve (the target's projectName), and becomes an ordinary publisher on the first successful upload.
For an existing project, open it from your projects and go to Manage → Publishing.

Both forms ask for:

Owner: the owner of your linked repository
Repository name: the repository name
Workflow name: release-please.yml
Environment: publish.pypi.releaseEnvironment, or blank when none is set

The automated publish runs as the publish job inside release-please.yml, so that is the workflow PyPI sees. If you also dispatch sdk-release.yml to re-publish a tag by hand, add it as a second publisher.

Keep the default config

{ "targets": { "python": { "publish": { "pypi": true } } } }

Publishing with a PyPI token

Create a PyPI API token

On pypi.org, go to Account settings → API tokens → Add API token. Scope it to your project once the project exists.

Add it to the repository

Add the token as a repository secret named PYPI_API_TOKEN. See Adding repository secrets. An existing PYPI_TOKEN secret is read when PYPI_API_TOKEN is unset. When publish.pypi.releaseEnvironment is set, an environment secret of the same name overrides the repository one.

Switch the target to token auth

{
  "targets": {
    "python": {
      "publish": { "pypi": { "authMethod": "access-token" } }
    }
  }
}

The workflow uses pypa/gh-action-pypi-publish and passes the token as the upload password.

Notes

skip-existing is enabled, so re-running a release for a version already on PyPI is a no-op.

TypeScript

The API company.