Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
The blessed :octocat: GitHub Action, for publishing your :package: distribution files to PyPI, the tokenless way: https://github.com/marketplace/actions/pypi-publish
| Date | Stars |
|---|---|
| 2026-07-30 | 1177 |
| 2026-08-06 | 1180 |
| 2026-08-15 | 1181 |
| 2026-08-18 | 1183 |
| 2026-08-20 | 1184 |
| 2026-09-01 | 1183 |
| 2026-09-03 | 1183 |
| 2026-09-16 | 1183 |
| 2026-09-18 | 1183 |
| 2026-09-19 | 1182 |
| 2026-09-24 | 1182 |
| 2026-09-26 | 1183 |
| 2026-09-29 | 1184 |
| 2026-10-02 | 1185 |
| 2026-10-03 | 1184 |
| 2026-10-04 | 1184 |
| 2026-10-18 | 1184 |
| 2026-10-21 | 1185 |
| 2026-10-23 | 1185 |
| 2026-10-28 | 1184 |
| 2026-11-01 | 1185 |
| 2026-11-04 | 1186 |
Today
+1 stars today
This week
+2 stars this week
This month
+2 stars this month
Momentum
41.0
growth rate 0.17%/day
[![SWUbanner]][SWUdocs]
![PyPA badge]
[![🧪 GitHub Actions CI/CD workflow tests badge]][GHA workflow runs list]
[![pre-commit.ci status badge]][pre-commit.ci results page]
[![GH Sponsors badge]][GH Sponsors URL]
# PyPI publish GitHub Action
This action allows you to upload your [Python distribution packages]
in the `dist/` directory to PyPI.
This text suggests a minimalistic usage overview. For a more detailed
walkthrough check out the [PyPA guide].
If you have any feedback regarding specific action versions, please leave
comments in the corresponding [per-release announcement discussions].
> [!TIP]
> A limited number of usage scenarios is supported, including the
> [PyPA guide] example. See the [non-goals] for more detail.
## 🌇 `master` branch sunset ❗
The `master` branch version has been sunset. Please, change the GitHub
Action version you use from `master` to `release/v1` or use an exact
tag, or opt-in to [use a full Git commit SHA] and Dependabot.
## Usage
### Trusted Publishing
> [!NOTE]
> Trusted publishing cannot be used from within a reusable workflow at this
> time. It is recommended to instead create a non-reusable workflow that contains a
> job calling your reusable workflow, and then do the trusted publishing step from
> a separate job within that non-reusable workflow. Alternatively, you can still
> use a username/token inside the reusable workflow.
> [!NOTE]
> Trusted Publishing is sometimes referred to by its
> underlying technology -- OpenID Connect, or OIDC for short.
> If you see references to "OIDC publishing" in the context of PyPI,
> this is what they're referring to.
This example jumps right into the current best practice. If you want to
use API tokens directly or a less secure username and password, check out
[how to specify username and password].
This action supports PyPI's [trusted publishing]
implementation, which allows authentication to PyPI without a manually
configured API token or username/password combination. To perform
[trusted publishing] with this action, your project's
publisher must already be [configured on PyPI].
To enter the trusted publishing flow, configure this action's job with the
`id-token: write` permission and **without** an explicit username or password:
```yaml
# .github/workflows/ci-cd.yml
jobs:
pypi-publish:
name: Upload release to PyPI
runs-on: ubuntu-latest
environment:
name: pypi
url: https://pypi.org/p/<your-pypi-project-name>
permissions:
id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
steps:
# retrieve your distributions here
- name: Publish package distributions to PyPI
uses: pypa/gh-action-pypi-publish@release/v1
```
> [!NOTE]
> Pro tip: instead of using branch pointers, like `unstable/v1`, pin versions of
> Actions that you use to tagged versions or sha1 commit identifiers.
> This will make your workflows more secure and more reproducible, saving you
> from sudden and unpleasant surprises.
Other indices that support trusted publishing can also be used, like TestPyPI:
```yaml
- name: Publish package distributions to TestPyPI
uses: pypa/gh-action-pypi-publish@release/v1
with:
repository-url: https://test.pypi.org/legacy/
```
_(don't forget to update the environment name to `testpypi` or similar!)_
> [!NOTE]
> Pro tip: only set the `id-token: write` permission in the job that does
> publishing, not globally. Also, try to separate building from publishing
> — this makes sure that any scripts maliciously injected into the build
> or test environment won't be able to elevate privileges while flying under
> the radar.
A common use case is to upload packages only on a tagged commit. To do so, add a
filter to the job:
```yml
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
```
### Generating and uploading attestations
> [!IMPORTANT]
> Support for generating and uploading [digital attestations] is currently
> limited to Trusted Excerpt of 16,627 characters
Read on GitHub
🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) · @Ansible Core Engineering Team @ @RedHatOfficial · maintainer @ @pypa / gh-action-pypi-publish & @CherryPy & @jazzband / pip-tools & @aio-libs · Python triager @ @python · Ukraine
267
William Woodruff · @astral-sh @openai · United States
58
20
15
Chak-Kuen Lam
9
7
Hugo van Kemenade · Finland
5
5
Nyakku Shigure · @PaddlePaddle · China
5
4
Henry Schreiner · Princeton University
3
3
Dustin Spicuzza
3
Quentin Pradet · @elastic
1
1
1
1
1
1
1
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:7f23259437a28544, topic:workflow, topic:workflow-automation