Publish packages from GitHub Actions

Create a token owned by the same personal account or organization as the target repository, then add it under Settings → Secrets and variables → Actions as RVS_TOKEN.

Python example

This workflow gives the durable secret only to rvs, mints a short-lived PyPI publish token, removes RVS_TOKEN, and gives only the minted token to Twine:

.github/workflows/publish-python.yml

name: Publish Python package

on:
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: "3.13"
      - name: Set up Ravenstash CLI
        uses: rvstash/setup-ravenstash@969c51bc762cc75cbe5707e99b63aedad7bd22da # v0.1.0
        with:
          version: "0.15.1"
      - name: Install build tools
        run: python -m pip install build twine
      - name: Build package
        run: python -m build
      - name: Mint registry token and publish
        env:
          RVS_TOKEN: ${{ secrets.RVS_TOKEN }}
        run: |
          RVS_PUBLISH_URL=$(rvs art endpoint \
            --target platform/packages \
            --format pypi \
            --access publish)
          RVS_NATIVE_TOKEN=$(rvs art token mint \
            --target platform/packages \
            --format pypi \
            --access publish)
          echo "::add-mask::$RVS_NATIVE_TOKEN"
          unset RVS_TOKEN
          export TWINE_USERNAME=rvs
          export TWINE_PASSWORD="$RVS_NATIVE_TOKEN"
          export TWINE_REPOSITORY_URL="$RVS_PUBLISH_URL"
          export TWINE_NON_INTERACTIVE=1
          python -m twine upload dist/*

Replace platform/packages with the namespace and repository names shown in Ravenstash.

rvstash/setup-ravenstash installs and verifies exactly the rvs version named in version; it never installs a newer release on its own. Pin the action to a full commit SHA and raise version deliberately after reading the CLI release notes.

RVS_TOKEN authorizes only the two rvs commands. Twine starts after that variable is removed and receives the target-scoped RVS_NATIVE_TOKEN instead.

npm

Mint a short-lived npm token before starting npm. Configure a temporary .npmrc to read RVS_NATIVE_TOKEN, as shown in Publish npm packages:

RVS_NATIVE_TOKEN=$(rvs art token mint \
  --target platform/packages \
  --format npm \
  --access publish)
unset RVS_TOKEN
export RVS_NATIVE_TOKEN
npm publish

Maven

Configure Maven to read RVS_NATIVE_TOKEN, then mint and publish:

RVS_NATIVE_TOKEN=$(rvs art token mint \
  --target platform/packages \
  --format maven \
  --access publish)
unset RVS_TOKEN
export RVS_NATIVE_TOKEN
mvn deploy

See Publish Maven artifacts for the matching server and repository configuration.

Protect release credentials

Use protected environments and approval rules for production publication where appropriate. Forked pull requests should not receive a publishing secret.