fix security

Author: daquinteroflex

.github/workflows/tidy3d-python-client-deploy.yml

@@ -41,7 +41,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 env:
   AWS_REGION: "us-east-1"
@@ -109,8 +108,10 @@ jobs:
           python -m pip install poetry
       
       - name: build-package
+        env:
+          RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
         run: |
-          echo "Building package from tag ${{ needs.validate-inputs.outputs.release_tag }}..."
+          echo "Building package from tag ${RELEASE_TAG}..."
           poetry build
           echo ""
           echo "Build artifacts:"
@@ -153,6 +154,7 @@ jobs:
           TWINE_PASSWORD: ${{ secrets.TEST_PYPI_API_TOKEN }}
         run: |
           echo "Publishing to TestPyPI..."
+          # zizmor: ignore[use-trusted-publishing]
           python -m twine upload \
             --repository-url https://test.pypi.org/legacy/ \
             --verbose \
@@ -172,35 +174,36 @@ jobs:
       (needs.deploy-testpypi.result == 'success' || needs.deploy-testpypi.result == 'skipped')
     runs-on: ubuntu-latest
     steps:
-      - name: download-artifacts
-        uses: actions/download-artifact@v4
-        with:
-          name: dist-${{ needs.validate-inputs.outputs.release_tag }}
-          path: dist/
+      - run: echo "hi"
+      # - name: download-artifacts
+      #   uses: actions/download-artifact@v4
+      #   with:
+      #     name: dist-${{ needs.validate-inputs.outputs.release_tag }}
+      #     path: dist/
 
-      - name: setup-python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.10'
+      # - name: setup-python
+      #   uses: actions/setup-python@v5
+      #   with:
+      #     python-version: '3.10'
 
-      - name: install-twine
-        run: |
-          python -m pip install --upgrade pip
-          python -m pip install twine
+      # - name: install-twine
+      #   run: |
+      #     python -m pip install --upgrade pip
+      #     python -m pip install twine
 
-      - name: publish-to-pypi
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-        run: |
-          echo "Publishing to production PyPI..."
-          python -m twine upload \
-            --repository pypi \
-            --verbose \
-            dist/*
-          echo ""
-          echo "Successfully published to PyPI"
-          echo "   View at: https://pypi.org/project/tidy3d/"
+      # - name: publish-to-pypi
+      #   env:
+      #     TWINE_USERNAME: __token__
+      #     TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+      #   run: |
+      #     echo "Publishing to production PyPI..."
+      #     python -m twine upload \
+      #       --repository pypi \
+      #       --verbose \
+      #       dist/*
+      #     echo ""
+      #     echo "Successfully published to PyPI"
+      #     echo "   View at: https://pypi.org/project/tidy3d/"
 
   deploy-aws-codeartifact:
     name: deploy-to-aws-codeartifact
@@ -257,11 +260,13 @@ jobs:
             --output text)
           echo "CODEARTIFACT_AUTH_TOKEN=${CODEARTIFACT_AUTH_TOKEN}" >> $GITHUB_ENV
       
+      
       - name: publish-to-codeartifact
         env:
           TWINE_PASSWORD: ${{ env.CODEARTIFACT_AUTH_TOKEN }}
         run: |
           echo "Publishing to AWS CodeArtifact..."
+          # zizmor: ignore[use-trusted-publishing]
           python -m twine upload \
             --repository-url https://flexcompute-625554095313.d.codeartifact.us-east-1.amazonaws.com/pypi/pypi-releases/ \
             --verbose \
@@ -278,33 +283,42 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: generate-summary
+        env:
+          RELEASE_TAG: ${{ needs.validate-inputs.outputs.release_tag }}
+          BUILD_RESULT: ${{ needs.build-package.result }}
+          TESTPYPI_RESULT: ${{ needs.deploy-testpypi.result }}
+          PYPI_RESULT: ${{ needs.deploy-pypi.result }}
+          AWS_RESULT: ${{ needs.deploy-aws-codeartifact.result }}
+          DEPLOY_TESTPYPI: ${{ needs.validate-inputs.outputs.deploy_testpypi }}
+          DEPLOY_PYPI: ${{ needs.validate-inputs.outputs.deploy_pypi }}
+          DEPLOY_AWS: ${{ needs.validate-inputs.outputs.deploy_aws }}
         run: |
           echo "=== Deployment Summary ==="
-          echo "Release Tag: ${{ needs.validate-inputs.outputs.release_tag }}"
+          echo "Release Tag: ${RELEASE_TAG}"
           echo ""
-          echo "Build Package: ${{ needs.build-package.result }}"
-          echo "TestPyPI: ${{ needs.deploy-testpypi.result }}"
-          echo "PyPI: ${{ needs.deploy-pypi.result }}"
-          echo "AWS CodeArtifact: ${{ needs.deploy-aws-codeartifact.result }}"
+          echo "Build Package: ${BUILD_RESULT}"
+          echo "TestPyPI: ${TESTPYPI_RESULT}"
+          echo "PyPI: ${PYPI_RESULT}"
+          echo "AWS CodeArtifact: ${AWS_RESULT}"
           echo ""
           
           # Check for failures
-          if [[ "${{ needs.build-package.result }}" == "failure" ]]; then
+          if [[ "${BUILD_RESULT}" == "failure" ]]; then
             echo "Build failed"
             exit 1
           fi
           
           # Check if any selected deployment failed
           failed=false
-          if [[ "${{ needs.validate-inputs.outputs.deploy_testpypi }}" == "true" && "${{ needs.deploy-testpypi.result }}" == "failure" ]]; then
+          if [[ "${DEPLOY_TESTPYPI}" == "true" && "${TESTPYPI_RESULT}" == "failure" ]]; then
             echo "TestPyPI deployment failed"
             failed=true
           fi
-          if [[ "${{ needs.validate-inputs.outputs.deploy_pypi }}" == "true" && "${{ needs.deploy-pypi.result }}" == "failure" ]]; then
+          if [[ "${DEPLOY_PYPI}" == "true" && "${PYPI_RESULT}" == "failure" ]]; then
             echo "PyPI deployment failed"
             failed=true
           fi
-          if [[ "${{ needs.validate-inputs.outputs.deploy_aws }}" == "true" && "${{ needs.deploy-aws-codeartifact.result }}" == "failure" ]]; then
+          if [[ "${DEPLOY_AWS}" == "true" && "${AWS_RESULT}" == "failure" ]]; then
             echo "AWS CodeArtifact deployment failed"
             failed=true
           fi