twine-upload: only nudge on PyPI-looking domains

Signed-off-by: William Woodruff <william@trailofbits.com>
pypa · Jul 10, 2023 · e90e853 · e90e853
1 parent be69596
commit e90e853
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/twine-upload.sh b/twine-upload.sh
@@ -59,12 +59,18 @@ elif [[ "${INPUT_USER}" == '__token__' ]]; then
     echo \
         '::notice::Using a user-provided API token for authentication' \
         "against ${INPUT_REPOSITORY_URL}"
-    echo "${TRUSTED_PUBLISHING_NUDGE}"
+
+    if [[ "${INPUT_REPOSITORY_URL}" =~ pypi\.org ]]; then
+        echo "${TRUSTED_PUBLISHING_NUDGE}"
+    fi
 else
     echo \
         '::notice::Using a username + password pair for authentication' \
         "against ${INPUT_REPOSITORY_URL}"
-    echo "${TRUSTED_PUBLISHING_NUDGE}"
+
+    if [[ "${INPUT_REPOSITORY_URL}" =~ pypi\.org ]]; then
+        echo "${TRUSTED_PUBLISHING_NUDGE}"
+    fi
 fi
 
 if [[