daniel156161
9bdd886d18
Build & Publish Package / publish (push) Successful in 58s
Package Extension / package-extension (push) Successful in 1m17s
Testing / test (3.10) (push) Successful in 1m15s
Testing / test (3.12) (push) Successful in 1m8s
Testing / test (3.15) (push) Successful in 9m38s
Testing / remote-protocol-compat (0.15.0) (push) Successful in 9m20s
Testing / remote-protocol-compat (0.16.0) (push) Successful in 8m54s
Testing / test (3.14) (push) Successful in 55s
- Move token lookup into scripts/pypi_token.sh, shared by both recipes - Resolve UV_PUBLISH_TOKEN, then .env, then pass api/packages/pypi - Fail with a clear hint instead of dropping into an interactive prompt - Never print the token, only its length - Gate publish behind version-check so version drift stops the build - Add publish-dry, same path as publish but with uv publish --dry-run - Pass --check-url so re-runs skip files already on PyPI - Hoist dist dir, token entry, and check URL into justfile variables - Add .env and .env.* to .gitignore The old recipe sourced .env for credentials, but .env was never ignored, so a token file dropped there would have been committed and shipped inside the sdist. Verified token precedence for env, .env and password-store, the missing-token exit code, the version-check gate, and a dry run against an unpublished version.
31 lines
964 B
Bash
31 lines
964 B
Bash
#!/usr/bin/env bash
|
|
# Resolve the PyPI token for `uv publish` without ever printing it.
|
|
#
|
|
# Order: an already exported UV_PUBLISH_TOKEN, then .env in the repo root, then
|
|
# the password-store entry passed as $1. The repo intentionally ships no .env,
|
|
# so the password-store path is the normal one on a dev machine.
|
|
|
|
load_pypi_token() {
|
|
local entry="${1:-}"
|
|
|
|
if [ -z "${UV_PUBLISH_TOKEN:-}" ] && [ -f .env ]; then
|
|
set -a
|
|
# shellcheck disable=SC1091
|
|
source .env
|
|
set +a
|
|
fi
|
|
|
|
if [ -z "${UV_PUBLISH_TOKEN:-}" ] && [ -n "$entry" ] && command -v pass >/dev/null 2>&1; then
|
|
UV_PUBLISH_TOKEN="$(pass "$entry" 2>/dev/null | head -1 || true)"
|
|
fi
|
|
|
|
if [ -z "${UV_PUBLISH_TOKEN:-}" ]; then
|
|
echo "error: no PyPI token found." >&2
|
|
echo " export UV_PUBLISH_TOKEN=..., put it in .env, or store it in: pass ${entry:-<entry>}" >&2
|
|
return 1
|
|
fi
|
|
|
|
export UV_PUBLISH_TOKEN
|
|
echo "Using PyPI token (${#UV_PUBLISH_TOKEN} chars) for upload."
|
|
}
|