fix(ci): stop publishing to PyPI through a reusable workflow - #139
Merged
Conversation
PyPI does not accept a reusable workflow as a trusted publisher -- pypi/warehouse#11096, unresolved. Both publish jobs here called reqstool/.github's python-publish-to-pypi.yml via workflow_call, so every real publish attempt failed at the OIDC exchange with invalid-publisher regardless of what the trusted publisher config named -- confirmed today, and it explains why publish-dev-to-testpypi.yml has been failing on every push to main since the 2026-08-16 migration. Switches both jobs to reqstool/.github's new actions/publish-to-pypi composite action, called directly from a job defined in this workflow. A composite action doesn't have the same problem: the OIDC claim is about which workflow file the job runs in, not what its steps reference. The two-index environment derivation (testpypi -> test, pypi -> stable) that the reusable workflow computed internally now has to be explicit per job -- a composite action can't set the caller's environment:. Needs reqstool/.github#92 merged first. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
PyPI accepts a pre-release version identifier (0.3.0rc1) on the real index directly, and pip ignores it without --pre -- there was never a need to route a release candidate to a separate staging index to hold it safely. Test PyPI existed here only as that safety net. publish-to-pypi now runs unconditionally instead of skipping for a release candidate, which also makes this consistent with what npm and Maven Central already do. publish-dev-to-testpypi.yml is deleted -- it's been failing on every push to main since the 2026-08-16 migration anyway (see reqstool/.github#92), and there's nowhere left for it to publish to. Needs reqstool/.github#92 merged first. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
4 tasks
CodeQL flagged actions/unpinned-tag: @main is a mutable ref, so a compromised or force-pushed reqstool/.github main would execute through this reference with no review. Pinned to the commit main pointed at when this action was added, matching the org's existing `@<sha> # main YYYY-MM-DD` convention for third-party/internal action references elsewhere in this repo. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Companion to reqstool/.github#92 — that PR
adds the
actions/publish-to-pypicomposite action, this one stops calling the reusableworkflow it replaces, and drops Test PyPI entirely.
PyPI does not accept a reusable workflow as a trusted publisher —
pypi/warehouse#11096, unresolved. Both
publish-to-testpypi/publish-to-pypiinrelease.ymlandpublish-to-test-pypiinpublish-dev-to-testpypi.ymlcalledpython-publish-to-pypi.ymlviaworkflow_call, soevery real publish attempt failed at the OIDC exchange with
invalid-publisher, regardlessof what the trusted publisher config on pypi.org named. Confirmed today from a real release
run, and it's the reason
publish-dev-to-testpypi.ymlhas been failing on every push tomain since the 2026-08-16 migration — a week of silent failures on the dev feed.
What changes
publish-to-pypinow callsreqstool/.github's newactions/publish-to-pypi— acomposite action, not a
workflow_callworkflow — directly from a job defined in thisrepo's own workflow file. That satisfies PyPI's requirement: the OIDC claim is about which
workflow file the job runs in, not what its steps reference.
(
0.3.0rc1) on the real index directly, and pip ignores it without--pre— there wasnever a need to route a release candidate to a separate staging index to hold it safely.
So
publish-to-testpypiis deleted rather than repaired,publish-to-pypirunsunconditionally instead of skipping for a release candidate (this also makes it consistent
with what npm and Maven Central already do here), and
publish-dev-to-testpypi.yml— thecontinuous dev feed to Test PyPI on every push to
main— is deleted outright, sincethere's nowhere left for it to publish to.
Needs reqstool/.github#92 merged first —
actions/publish-to-pypi@maindoesn't existuntil then.
Checklist
git commit -s).Test plan
YAML validated locally. The real test is a dispatch once reqstool/.github#92 is merged: a
real release run reaching
publish-to-pypi(this is what failed before — seereqstool/.github#92's description for the failed run), including once with
prerelease: rcto confirm a candidate now publishes to the real index rather than being silently skipped.