fix(ci): PyPI publish never ran, and could not have worked anyway - #20
Merged
Conversation
Two independent faults, both silent. **It never fired.** The trigger was `release: created`. Once release.yml started cutting releases automatically, that became a dead end: GitHub does not trigger workflows from events raised with the default GITHUB_TOKEN, precisely to avoid recursion. So v0.9.0 was tagged, the release appeared, and nothing reached PyPI. Now it triggers on the tag directly, the same event release.yml uses, so neither depends on the other. **The credentials are dead.** PyPI stopped accepting username and password; TWINE_USERNAME/TWINE_PASSWORD returns 403 Forbidden from upload.pypi.org. That is what the 2026-08-14 12:49 run failed on, and the March run before it. Switched to the token form: literal __token__ as the username, an API token as the password. **Needs a secret before it works:** add PYPI_API_TOKEN in repo settings, scoped to this project. The old PYPI_USERNAME and PYPI_PASSWORD can then be deleted. Until that secret exists, 0.9.0 has to go up by hand.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found while checking whether 0.9.0 reached PyPI. It did not, and there are two
separate reasons, each of which alone would have been enough.
1. The workflow never fired
The trigger was
release: created. That worked while releases were made byhand. Once
release.ymlstarted cutting them from tags, it became a dead end:GitHub does not trigger workflows from events raised with the default
GITHUB_TOKEN, to avoid recursion.So for v0.9.0 the tag landed,
release.ymlcreated the release asgithub-actions[bot], andpublish.ymlwas never invoked. No error anywhere,just silence.
Now it triggers on the tag directly, the same event
release.ymluses. The tworun in parallel and neither depends on the other.
2. The credentials could not have worked
PyPI stopped accepting username and password. The existing
TWINE_USERNAME/TWINE_PASSWORDpair returns:That is what the run on 2026-08-14 12:49 failed on, and the one before it in
March. So even if the trigger had worked, this would have failed.
Switched to the token form: literal
__token__as the username, an API token asthe password.
What this PR does not fix
Someone has to add
PYPI_API_TOKENin repo settings, scoped to this project.Once it exists,
PYPI_USERNAMEandPYPI_PASSWORDcan be deleted.Until then, 0.9.0 has to be uploaded by hand. Worth considering
Trusted Publishing instead, which
needs no stored secret at all, but that requires configuration on the PyPI side
so I have left it as a suggestion rather than assuming it.
Note for the other repos
release.ymlin dexpaprika-mcp, dexpaprika-sdk-go, dexpaprika-sdk-ts anddexpaprika-sdk-php has the same bot-token property. It does not matter there
because nothing chains off the release, but it is worth knowing before anyone
adds a publish step that listens for one.