Repository navigation
Publish blurb to PyPI using Trusted Publishers #4
Description
The short story
It would be nice to automate releases.
Long version
Similar to cherry_picker (python/cherry-picker#94), let's set up automated deploys to PyPI.
We'll need to pick a tag name format, so far we only have cherry-picker-vX.Y.Z in this repo: https://github.com/python/core-workflow/tags. Shall we use blurb-vX.Y.Z here?
TODO
- Move blurb to own repo Should blurb and cherry_picker move to their own repos? core-workflow#329
- Decide on tag name
- Reserve blurb on https://test.pypi.org/project/blurb/
- Add other people to https://test.pypi.org/project/blurb/ to improve bus factor - who else shall I add there?
- Create release workflow: python/blurb#14
- Set up Trusted Publisher on https://test.pypi.org/project/blurb/
- Set up Trusted Publisher on https://pypi.org/project/blurb/
Thanks for blurb!
Activity
ezio-melotti commentedon Mar 21, 2024
I would add "move
blurbto its own repo" at the top of the checklist, otherwise sounds good to me.hugovk commentedon Mar 21, 2024
Added!
Once in its own repo, we don't need to worry about tag collisions and can use a more standard
X.Y.ZorvX.Y.Z.hugovk commentedon Mar 28, 2024
blurb is now in its own repo 🚀
No strong preference from me, some prefer
vX.Y.Zbecause it allows matching with av*wildcard. We alsoX.Y.Zfor branches andvX.Y.Zfor tags in https://github.com/python/cpython, so "copy CPython" is good enough for me: let's usevX.Y.Z.I've set up the Trusted Publisher for TestPyPI at https://test.pypi.org/manage/project/blurb/settings/publishing/
Here's a PR to add the release workflow: python/blurb#14. We can merge this before setting it up on production PyPI, it'll verify the TestPyPI setup.
Then we need to set up production PyPI before doing a proper release.
webknjaz commentedon Apr 4, 2024
@hugovk I suggest using a GitHub Environment called
testpypifor the TestPyPI uploads andpypifor the regular PyPI. This is what I use in the guides and IRL.hugovk commentedon Apr 12, 2024
I merged #14 and it successfully deployed in https://github.com/python/blurb/actions/runs/8661563398/job/23751747417 to https://test.pypi.org/project/blurb/0.1.dev64/ ✅
hugovk commentedon Apr 12, 2024
@ambv Can I add you? Do you have a Test PyPI account?
I see Brett and Larry listed at https://pypi.org/project/blurb/
@brettcannon or @larryhastings:
Please could you either set up Trusted Publishers for blurb here using the same settings as #4 (comment)
OR add @ambv and I'll ask him to do it?
Thanks!
ambv commentedon Apr 12, 2024
I'm happy to help! I'm ambvtest on test.pypi.org.
hugovk commentedon Apr 12, 2024
Thanks, invited!
ambv commentedon Apr 12, 2024
Accepted!
webknjaz commentedon Apr 12, 2024
Correction: the settings should be almost the same. The
Environment namefield must bepypiper 4bcc5b1. In case of a mismatch, PyPI will reject uploads.hugovk commentedon Jul 3, 2024
@brettcannon When you get a moment, please could you either set up Trusted Publishers for blurb here using the same settings as #4 (comment)?
Or add @ambv or me to the PyPI project and we can do it?
Thank you!
brettcannon commentedon Jul 3, 2024
@hugovk I unfortunately can't as I'm not an admin on the project. @larryhastings will need to add someone to make the changes.
larryhastings commentedon Jul 3, 2024
I don't think I'm an admin on this project either.
webknjaz commentedon Jul 3, 2024
@larryhastings @brettcannon only you two are listed on PyPI as maintainers. This means one of you must be an owner. Unless PyPI itself is broken somehow.
larryhastings commentedon Jul 4, 2024
It's entirely possible I'm being dumb. But I'm logged in to Github as myself, and I don't see the "Settings" tab along the top for this repository. I thought that meant I was just a contributor, not a maintainer. If I'm wrong about that, how can I determine my maintainer status on this project?
hugovk commentedon Jul 4, 2024
This is about PyPI not GitHub:
ambvand mine ishugovk.larryhastings commentedon Jul 4, 2024
Okay, I understand. And yes Brett and I are the two maintainers of blurb on PyPI.
I'm not allowed to change anything on blurb until I enable 2FA. I'm busy just now, give me a day or two to deal with this. (Unless Brett gets to it first or something.)
webknjaz commentedon Jul 4, 2024
@larryhastings since Brett said he doesn't have access, I assume that his access is "Maintainer" (only allows uploading new releases IIRC) and yours is "Owner". Most things are only available to Owners. In case of putting a project under an org, the RBAC would be a bit more flexible than that. But registering orgs on PyPI is on pause per my understanding.
So if you want someone else to configure trusted publishing, make sure to add them as an owner.
hugovk commentedon Jul 4, 2024
@webknjaz I requested the "python" and "cpython" PyPI organisations in December, no news yet: https://discuss.python.org/t/request-python-organisation-on-pypi/26545/9
webknjaz commentedon Jul 4, 2024
@hugovk I know. That PyPI support engineer might be able to get through the queue later on. I asked Mike at PyCon and apparently, they don't want to make exceptions to demonstrate to companies that they need to fund more positions like that.
larryhastings commentedon Jul 5, 2024
I've added
hugovkas a Maintainer. Is that sufficient?hugovk commentedon Jul 5, 2024
Thanks, I've accepted, but Owner permission is needed to be able to click the Manage button to set it up:
https://docs.pypi.org/trusted-publishers/adding-a-publisher/
I see:
Please could you add Owner permissions?
hugovk commentedon Jul 5, 2024
Thank you! I now have Owner permissions and have set up Trusted Publishing like this at https://pypi.org/manage/project/blurb/settings/publishing/:
I'll prepare and make a release in the near future to test it out, and update https://github.com/python/blurb/blob/main/RELEASING.md as needed.
I've also invited developer-in-residence @ambv as Owner to help with bus factor.
hugovk commentedon Jul 7, 2024
Successfully released!
Thanks all!