publish packages to GAR

.github/workflows/build.yaml

@@ -51,6 +51,9 @@ jobs:
           venv/bin/license-check
 
   build-and-release:
+    permissions:
+      contents: read
+      id-token: write
     if: ${{ github.ref == 'refs/heads/main' }}
     needs: test
     runs-on: ubuntu-latest
@@ -72,6 +75,13 @@ jobs:
         run: sed 's/dynamic = \["version"]/# dynamic = ["version"]\nversion = "'"$RELEASE_TAG"'"/' -i pyproject.toml
       - name: Build wheel
         run: venv/bin/python -m build
+      - uses: google-github-actions/auth@v1
+        with:
+          workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: artifact-writer@${{ secrets.GCP_PROJECT_ID }}.iam.gserviceaccount.com
+      - name: Publish package
+        run:
+          venv/bin/twine upload --verbose --repository-url https://us-python.pkg.dev/${{ secrets.GCP_PROJECT_ID }}/cavendish-prod-python/ dist/*.whl
       - name: Publish release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

requirements.in

@@ -1,8 +1,10 @@
 click==8.1.7
 google-cloud-pubsub==2.23.0
 google-cloud-storage==2.18.2
+keyrings.google-artifactregistry-auth
 pip-tools==7.4.1
 pytest==8.3.2
 requests==2.32.3
 ruff==0.5.7
 sentry-sdk==2.12.0
+twine==5.1.1