pypa/pypi-publish

Upload Python distribution packages to PyPI

View on GitHub

Trust Signals

Scorecard Score
Scorecard 4–6scored Jul 6, 2026
Maintenance Recency
Activelast commit May 21, 2026
License
BSD

Pinned Snippet

workflow.ymlSHA-pinned
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

tags can be moved; commit SHAs can't. why a SHA?

namedescriptionrequireddefault
userPyPI userno__token__
passwordPassword for your PyPI user or an access tokenno
repository-urlThe repository URL to useno
repository_url[DEPRECATED] The repository URL to usenohttps://upload.pypi.org/legacy/
packages-dirThe target directory for distributionno
packages_dir[DEPRECATED] The target directory for distributionnodist
verify-metadataCheck metadata before uploadingno
verify_metadata[DEPRECATED] Check metadata before uploadingnotrue
skip-existingDo not fail if a Python package distribution exists in the target package indexno
skip_existing[DEPRECATED] Do not fail if a Python package distribution exists in the target package indexnofalse
verboseShow verbose output.notrue
print-hashShow hash values of files to be uploadedno
print_hash[DEPRECATED] Show hash values of files to be uploadednotrue
attestationsEnable support for PEP 740 attestations. Only works with PyPI and TestPyPI via Trusted Publishing.notrue

no outputs