-
Notifications
You must be signed in to change notification settings - Fork 951
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
"login" or dry-run validity check for tokens #6407
Comments
I think the best way to do this is to implement #726. |
I think to address this issue, we'd probably need to provide an API for testing credentials separate from #726, as it doesn't quite solve the problem of "once we built everything, our upload failed due to bad credentials, and we can't test credentials without trying to upload something". Presumably once #726 is implemented, maintainers could attempt to upload some dummy release to test credentials, but this isn't as ideal as just providing an API for something like However there is an additional complication to consider here (also discussed in pypa/twine#355 and pypa/twine#475) which is that the validity of API tokens depends on what's being uploaded along with them. Edit: and similarly for basic authentication, the validity of credentials would need to be considered on a per-project basis. |
For sure, tho just from my own perspective, I am willing to own that risk (we have never run in to that particular problem, but we have definitely had botched releases due to a credential issue on some or other account mid-process) |
This might fall under #13409. |
What's the problem this feature will solve?
Our project has to simultaneously publish docs, PyPI, conda, and npm packages. If one of those fails (e.g. because a token has expired) then it's a really bad day. So it's really ideal for us to be able to "test" all the credentials are valid up front, before actually really attempting any of the uploads.
Describe the solution you'd like
npm
providesnpm login
and there is also ananaconda login
Any reasonable way to peform a dry-run of an upload without actually doing the upload would be helpful to ensure that we don't get partway through a release before discovering a credentials problem.The text was updated successfully, but these errors were encountered: