russell@unturf.com
f595015582
Pipeline #40358 (v0.1.4) failed with the same OIDC error as 0.1.0: TrustedPublishingFailure: Unable to retrieve an OIDC token from the CI platform for trusted publishing GitLab: Environment variable PYPI_ID_TOKEN not found Twine 6's default is --trusted-publishing automatic, which ALWAYS tries OIDC first when it detects GitLab CI env vars, regardless of whether TWINE_USERNAME/TWINE_PASSWORD are set. Adding '--trusted-publishing never' forces classic API token auth via env vars (or .pypirc) and skips the OIDC dance entirely. Plus a sanity-check that the group-scoped TWINE_USERNAME and TWINE_PASSWORD vars actually landed in the env on this pipeline ('set' or 'MISSING' — never echoes the value). If they're MISSING despite being configured at the python/ group level, the most likely cause is the vars being marked Protected while the tag isn't a protected ref (Settings -> Repository -> Protected tags).
57 lines
2.4 KiB
YAML
57 lines
2.4 KiB
YAML
stages:
|
|
- test
|
|
- pypi-twine
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Tests run on every push to any branch.
|
|
#
|
|
# Live-integration tests need EPMD on the runner — ``make all`` skips
|
|
# them automatically when EPMD isn't reachable. CI runners typically
|
|
# don't run EPMD, so we get unit-level coverage in CI and full
|
|
# integration coverage on the dev machine.
|
|
# ---------------------------------------------------------------------------
|
|
test:
|
|
stage: test
|
|
tags: ["build"]
|
|
except:
|
|
- tags
|
|
script:
|
|
- python3 -m venv .venv
|
|
- . .venv/bin/activate
|
|
- pip install --upgrade pip wheel
|
|
- pip install -e ".[dev]"
|
|
- pytest -v
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Ship to PyPI on tag pushes.
|
|
#
|
|
# Auth: TWINE_USERNAME + TWINE_PASSWORD env vars come from project-scoped
|
|
# GitLab CI variables (Settings → CI/CD → Variables, masked + protected).
|
|
# Standard values: TWINE_USERNAME=__token__ and TWINE_PASSWORD=<pypi-...>.
|
|
#
|
|
# Trusted Publishing OIDC would be cleaner but PyPI's GitLab provider is
|
|
# hardcoded to gitlab.com — git.unturf.com self-hosted isn't supported.
|
|
# See docs/PYPI-TRUSTED-PUBLISHING.md for the migration recipe whenever
|
|
# PyPI adds custom-issuer support (or whenever we mirror to gitlab.com).
|
|
# ---------------------------------------------------------------------------
|
|
pypi-twine:
|
|
stage: pypi-twine
|
|
tags: ["build"]
|
|
only:
|
|
- tags
|
|
script:
|
|
# Sanity-check that the group-scoped CI vars actually landed in the
|
|
# env on this pipeline. Prints "set" or "MISSING" — never the value,
|
|
# never echoes them anywhere — so masked/protected flags stay safe.
|
|
- 'test -n "${TWINE_USERNAME:-}" && echo "TWINE_USERNAME: set" || echo "TWINE_USERNAME: MISSING (check group vars Protected flag vs tag protection)"'
|
|
- 'test -n "${TWINE_PASSWORD:-}" && echo "TWINE_PASSWORD: set" || echo "TWINE_PASSWORD: MISSING (check group vars Protected flag vs tag protection)"'
|
|
- python3 -m venv .venv
|
|
- . .venv/bin/activate
|
|
- pip install --upgrade pip
|
|
- pip install build twine
|
|
- python -m build
|
|
- twine check dist/*
|
|
# --trusted-publishing never: twine 6 defaults to attempting OIDC
|
|
# when it detects GitLab CI, even if TWINE_USERNAME/TWINE_PASSWORD
|
|
# are set. Explicitly disable OIDC so it uses the env vars directly.
|
|
- twine upload --non-interactive --trusted-publishing never dist/*
|