From f59501558243edaa56b7babefea3e47f1e099d51 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Tue, 16 Jun 2026 15:06:56 -0400 Subject: [PATCH] twine: --trusted-publishing never + env-var diagnostic, v0.1.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pipeline #40358 (v0.1.4) failed with the same OIDC error as 0.1.0: TrustedPublishingFailure: Unable to retrieve an OIDC token from the CI platform for trusted publishing GitLab: Environment variable PYPI_ID_TOKEN not found Twine 6's default is --trusted-publishing automatic, which ALWAYS tries OIDC first when it detects GitLab CI env vars, regardless of whether TWINE_USERNAME/TWINE_PASSWORD are set. Adding '--trusted-publishing never' forces classic API token auth via env vars (or .pypirc) and skips the OIDC dance entirely. Plus a sanity-check that the group-scoped TWINE_USERNAME and TWINE_PASSWORD vars actually landed in the env on this pipeline ('set' or 'MISSING' — never echoes the value). If they're MISSING despite being configured at the python/ group level, the most likely cause is the vars being marked Protected while the tag isn't a protected ref (Settings -> Repository -> Protected tags). --- .gitlab-ci.yml | 10 +++++++++- erldistpy/__init__.py | 2 +- pyproject.toml | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index d01220a..2a3e26d 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -40,10 +40,18 @@ pypi-twine: only: - tags script: + # Sanity-check that the group-scoped CI vars actually landed in the + # env on this pipeline. Prints "set" or "MISSING" — never the value, + # never echoes them anywhere — so masked/protected flags stay safe. + - 'test -n "${TWINE_USERNAME:-}" && echo "TWINE_USERNAME: set" || echo "TWINE_USERNAME: MISSING (check group vars Protected flag vs tag protection)"' + - 'test -n "${TWINE_PASSWORD:-}" && echo "TWINE_PASSWORD: set" || echo "TWINE_PASSWORD: MISSING (check group vars Protected flag vs tag protection)"' - python3 -m venv .venv - . .venv/bin/activate - pip install --upgrade pip - pip install build twine - python -m build - twine check dist/* - - twine upload --non-interactive dist/* + # --trusted-publishing never: twine 6 defaults to attempting OIDC + # when it detects GitLab CI, even if TWINE_USERNAME/TWINE_PASSWORD + # are set. Explicitly disable OIDC so it uses the env vars directly. + - twine upload --non-interactive --trusted-publishing never dist/* diff --git a/erldistpy/__init__.py b/erldistpy/__init__.py index 01bb76c..ccb7a08 100644 --- a/erldistpy/__init__.py +++ b/erldistpy/__init__.py @@ -1,6 +1,6 @@ """erldistpy — native Python client for our Erlang distribution protocol.""" -__version__ = "0.1.4" +__version__ = "0.1.5" from erldistpy.channel import Channel, ChannelError, IncomingMessage from erldistpy.epmd import EpmdError, EpmdInfo, lookup diff --git a/pyproject.toml b/pyproject.toml index 2f198d2..96e3242 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "erldistpy" -version = "0.1.4" +version = "0.1.5" description = "Native Python client for Erlang distribution protocol — EPMD + v6 handshake + gen_server call(), no asyncio." readme = { file = "README.md", content-type = "text/markdown" } requires-python = ">=3.10"