How to publish to PyPI using GitHub Actions securely

🫧 Open on Bubbles There have been several security incidents lately that involved compromising GitHub Actions workflows. This has led some to say " GitHub Actions is the weakest link " in publishing and to GitHub publishing a GitHub Actions security roadmap update . But saying it's an issue and acknowledging the fact is one thing, but you still need to do the mitigation work today so you are not going to be the next headline. So this post is going to outline 3 things to do so you can publish to PyPI securel