support Trusted Publishers

[casperdcl]

• password.required: false
• registry-domain.default: https://upload.pypi.org
• if password undefined, generate OIDC "password"

  audience=$(GET $INPUT_REGISTRY_DOMAIN/_/oidc/audience)
  oidc_token=$(GET $ACTIONS_ID_TOKEN_REQUEST_URL -d "$audience" -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" | jq "{token: .value}")
  TWINE_PASSWORD=$(POST $INPUT_REGISTRY_DOMAIN/_/oidc/github/mint-token -d "$oidc_token" | jq -r .token)

references

• description: https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers#using-trusted-publishing-with-github-actions
• implementation: https://github.com/pypa/gh-action-pypi-publish/blob/unstable/v1/oidc-exchange.py
• detect_github(audience) -> oidc_token: https://github.com/di/id/blob/main/id/_internal/oidc/ambient.py
• GHA env vars: https://docs.github.com/en/actions/learn-github-actions/variables#default-environment-variables

[0x2b3bfa0]

Would a shell script be enough, or does it have to be pure Python?

curl --get "$ACTIONS_ID_TOKEN_REQUEST_URL" \
     --header "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
     --data $(curl "https://$REGISTRY_DOMAIN/_/oidc/audience") |
jq "{token: .value}" |
curl "https://$REGISTRY_DOMAIN/_/oidc/github/mint-token" --data @- |
jq --raw-output .value

Note that #17 (comment) is wrong, and $REGISTRY_DOMAIN is the host name of the registry; e.g. upload.pypi.org

[casperdcl]

shell script is the only thing supported¹

Footnotes

1. https://github.com/casperdcl/deploy-pypi#why "Has the entirety of the code in a single file, making it very easy to review" ↩

[casperdcl]

https://github.com/pypa/gh-action-pypi-publish/blob/a712d989cca7b5d2b239f655efb2512082d5bce8/action.yml#L12-L23

looks like it's meant to be https://upload.pypi.org

[0x2b3bfa0]

shell script is the only thing supported

I asked because the only ™️ thing your shell script does is invoking the python executable in every conceivable way. Maybe you wanted something along the lines of python -c 'urllib ...' instead of curl and jq for this?

[0x2b3bfa0]

looks like it's meant to be https://upload.pypi.org

It also works with pypi.org but you're right; updated!