Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update release workflow to use PyPI trusted publishing #94

Merged
merged 2 commits into from
Nov 2, 2023

Conversation

mattt
Copy link
Contributor

@mattt mattt commented Apr 24, 2023

Resolves #92

Signed-off-by: Mattt Zmuda <mattt@replicate.com>
@mattt
Copy link
Contributor Author

mattt commented Apr 24, 2023

PyPI trusted functionality is currently limited to a closed beta testers' group. I've signed up for access using the form linked from pypi/warehouse#12965.

Holding as draft until this feature is available to us.

@mattt
Copy link
Contributor Author

mattt commented Oct 9, 2023

I haven't heard back from PyPI, but it appears that trusted publishing is now generally available.

@mattt mattt marked this pull request as ready for review October 9, 2023 11:51
@mattt mattt merged commit 3443c91 into main Nov 2, 2023
8 checks passed
@mattt mattt deleted the mattt/trusted-publishers branch November 2, 2023 13:40
mattt added a commit that referenced this pull request Nov 2, 2023
This reverts commit 3443c91.

Signed-off-by: Mattt Zmuda <mattt@replicate.com>
@mattt
Copy link
Contributor Author

mattt commented Nov 2, 2023

Reverted by e7b3f9f

Failing run: https://github.com/replicate/replicate-python/actions/runs/6733395047/job/18302176951#step:7:16

Error: Trusted publishing exchange failure: 
Token request failed: the server refused the request for the following reasons:

* `invalid-publisher`: valid token, but no corresponding publisher (All lookup strategies exhausted)

This generally indicates a trusted publisher configuration error, but could
also indicate an internal error on GitHub or PyPI's part.


The claims rendered below are **for debugging purposes only**. You should **not**
use them to configure a trusted publisher unless they already match your expectations.

If a claim is not present in the claim set, then it is rendered as `MISSING`.

* `sub`: `repo:replicate/replicate-python:ref:refs/tags/0.15.6`
* `repository`: `replicate/replicate-python`
* `repository_owner`: `replicate`
* `repository_owner_id`: `60410876`
* `job_workflow_ref`: `replicate/replicate-python/.github/workflows/release.yaml@refs/tags/0.15.6`
* `ref`: `refs/tags/0.15.6`

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update release workflow to use PyPI Trusted Publishers
1 participant