sdk_publish.yaml

name: Publish
permissions:
  checks: write
  contents: write
  pull-requests: write
  statuses: write
  id-token: write
on:
  push:
    branches:
      - main
    paths:
      - RELEASES.md
      - '*/RELEASES.md'
jobs:
  mint-token:
    runs-on: ubuntu-latest
    steps:
      - name: Mint API token
        id: mint-token
        run: |
          # retrieve the ambient OIDC token
          resp=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
          "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=pypi")
          oidc_token=$(jq -r '.value' <<< "${resp}")

          # exchange the OIDC token for an API token
          resp=$(curl -X POST https://pypi.org/_/oidc/mint-token -d "{\"token\": \"${oidc_token}\"}")
          api_token=$(jq -r '.token' <<< "${resp}")

          # mask the newly minted API token, so that we don't accidentally leak it
          echo "::add-mask::${api_token}"

          # set the environment variable for the job
          echo "API_TOKEN=${api_token}" >> $GITHUB_ENV
  publish:
    needs: mint-token
    uses: speakeasy-api/sdk-generation-action/.github/workflows/sdk-publish.yaml@v15
    secrets:
      github_access_token: ${{ secrets.GITHUB_TOKEN }}
      pypi_token: ${{ github.env.API_TOKEN }}
      speakeasy_api_key: ${{ secrets.SPEAKEASY_API_KEY }}