-
-
Notifications
You must be signed in to change notification settings - Fork 83
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Proposal: warn the user on user/password pair use #187
Comments
I've been reminded that PyPI is enforcing 2FA beginning in 2024, so this issue is somewhat of a moot point -- password authentication for package uploads will stop working anyways 🙂 So I'll amend the focus here: rather than prematurely rejecting, we should probably start voluminously warning users of this workflow that they'll begin to experience breakage soon and should migrate either to an API token or trusted publishing. |
Agreed to start warning, since we know that Trusted Publishers is the solution for almost everyone let's point to that primarily. Off-handed I wonder how hard it is to detect whether we're being run in a reusable workflow (and therefore can recommend API keys). |
This is definitely doable by decoding the JWT itself, but that's pretty hacky. I'll see if there's some other signal we can use. |
Looks like comparing |
Opened #190 for this. |
In some cases, yes. My understanding is that it requires |
Filing this as a proposal, since it'll probably need a bit of discussion/deprecation planning.
Rationale:
Proposal: when the target is PyPI or TestPyPI, fail (with an explanatory error message) any run of the workflow that:
__token__
and a password ofpypi-...
).Other considerations:
TWINE_USERNAME
etc. directly (if the action exposes these?)CC @di @sethmlarson for thoughts as well (this came up during discussion between the three of us)
The text was updated successfully, but these errors were encountered: