Unclear reason why upload fails

[glensc]

Please help to understand why upload fails from GitHub Actions.

action file:

• https://github.com/Taxel/PlexTraktSync/blob/a42c30eecf116b224ca540e73a84d9f499a0df3d/.github/workflows/pypi.yml (via PR)
• https://github.com/glensc/plex-trakt-sync/blob/a42c30eecf116b224ca540e73a84d9f499a0df3d/.github/workflows/pypi.yml (owner repo)

job output:

• https://github.com/glensc/plex-trakt-sync/runs/3713108333?check_suite_focus=true

I've done in job output echo -n "${{ secrets.PYPI_TOKEN }}" | sha1sum/ echo -n "${{ secrets.TESTPYPI_TOKEN }}" | sha1sum and compared with locally saved token value, the checksum was identica.

with the same token used for test/prod, I was able to upload from local successfully:

• python3 -m twine upload dist/*
  • https://pypi.org/project/PlexTraktSync/0.13.27.post69/
• python3 -m twine upload --repository testpypi dist/*
  • https://test.pypi.org/project/PlexTraktSync/0.13.27.post69/

[webknjaz]

Have you tried simply re-adding the token? Maybe you've got some trailing whitespaces? Have you checked if you maybe confused PyPI and TestPyPI tokens? I see that the step that uploads to the regular PyPI refers to the token for TestPyPI (at least, it's called TESTPYPI_TOKEN in your workflow, I would expect it to be PYPI_TOKEN): https://github.com/glensc/plex-trakt-sync/actions/runs/1275315679/workflow#L56.

[webknjaz]

None of the links demonstrate what you said. I still think that you pass an incorrect token in GHA. FWIW this action invokes twine upload, just like you do locally. It works if the token is valid.

[glensc]

well, I rewrote history, so echo for PYPI_TOKEN or TESTPYPI_TOKEN is no longer there.

however, it was the token problem, found it had space in the middle.

perhaps just trim and remove whitespace from token value to allow to recover for such common mistakes. the token can't contain space, so it's fine to remove any whitespace from its value programmatically before passing to twine.

[webknjaz]

I don't think it's a good idea to make any silent magical transformations. But it could be reasonable to issue warnings.

[glensc]

I like the warning idea!

[webknjaz]

If you feel like sending a PR, here's how the existing warnings are implemented:
https://github.com/pypa/gh-action-pypi-publish/blob/bea5cda/twine-upload.sh#L5-L32