invalid-publisher error

[brianmay]

See https://github.com/Karaage-Cluster/karaage/actions/runs/13609307933/job/38044511159

Token request failed: the server refused the request for the following reasons:

* `invalid-publisher`: valid token, but no corresponding publisher (All lookup strategies exhausted)

This generally indicates a trusted publisher configuration error, but could
also indicate an internal error on GitHub or PyPI's part.


The claims rendered below are **for debugging purposes only**. You should **not**
use them to configure a trusted publisher unless they already match your expectations.

If a claim is not present in the claim set, then it is rendered as `MISSING`.

* `sub`: `repo:Karaage-Cluster/karaage:environment:pypi`
* `repository`: `Karaage-Cluster/karaage`
* `repository_owner`: `Karaage-Cluster`
* `repository_owner_id`: `931380`
* `workflow_ref`: `Karaage-Cluster/karaage/.github/workflows/release-please.yml@refs/heads/main`
* `job_workflow_ref`: `Karaage-Cluster/karaage/.github/workflows/release-please.yml@refs/heads/main`
* `ref`: `refs/heads/main`

My trusted publisher config is:

Repository: [Karaage-Cluster/karaage](https://github.com/Karaage-Cluster/karaage)
Workflow: release-please.yml
Environment name: pypi

The workflow (https://github.com/Karaage-Cluster/karaage/blob/main/.github/workflows/release-please.yml) is:

  upload-pypi:
    name: Upload to pypi
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write
    steps:
    - uses: actions/checkout@v4
    - name: Set up Python 3.12
      uses: actions/setup-python@v5
      with:
        python-version: 3.12
    - name: Run image
      uses: abatilo/actions-poetry@v4
      with:
        poetry-version: main
    - name: Setup a local virtual environment (if no poetry.toml file)
      run: |
        poetry config virtualenvs.create true --local
        poetry config virtualenvs.in-project true --local
    - uses: actions/cache@v4
      name: Define a cache for the virtual environment based on the dependencies lock file
      with:
        path: ./.venv
        key: venv-${{ hashFiles('poetry.lock') }}
    - name: Install system dependancies
      run: |
        sudo apt-get update
        sudo apt-get install libcrack2-dev
    - name: Install the project dependencies
      run: poetry install
    - name: Package project
      run: poetry build
    - name: Publish package distributions to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1

I am almost certain I did something wrong, but I just can't see anything wrong.

If I create a new publisher without the environment name, then it works. But I just can't see anything wrong with the environment name.

[brianmay]

Curiously, I have a very similar config working in another project.

[webknjaz]

cc @woodruffw @di I don't see anything obvious in the config. Any chance to lurk into the PyPI logs?

[webknjaz]

Does recreating the publisher with the environment work? I've seen rare race conditions in the past when repository/project transfers were happening. Try it.

Also, I see you give the transitive build deps power to impersonate your repository with other entities through OIDC. Don't do that. It's dangerous and therefore unsupported.

[brianmay]

Yes, recreating the publisher did seem to work.

When copying and pasting the "pypi" I noticed this time I got a white space character before " pypi", which I deleted. Wonder if this was the problem...

Also, I see you give the transitive build deps power to impersonate your repository with other entities through OIDC. Don't do that. It's dangerous and therefore unsupported.

Still trying to understand github action permissions. And this is what the example seems to be telling me to do:

jobs:
  pypi-publish:
    name: Upload release to PyPI
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/<your-pypi-project-name>
    permissions:
      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
    steps:
    # retrieve your distributions here

    - name: Publish package distributions to PyPI
      uses: pypa/gh-action-pypi-publish@release/v1

Is this due to the permissions: { id-token: write }? How do I fix this?

[brianmay]

Oh, saw this further on in that page:

Pro tip: only set the id-token: write permission in the job that does publishing, not globally. Also, try to separate building from publishing — this makes sure that any scripts maliciously injected into the build or test environment won't be able to elevate privileges while flying under the radar.

Does somebody have an example of how to do this?

[brianmay]

I found some steps here: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/

Which hopefully I have adopted now.

[webknjaz]

Would rephrasing this is readme help land on the proper solution faster? Any suggestions?

[brianmay]

I think an example that shows the build steps and publish steps would be ideal. Maybe an example that builds from pyproject.toml in what is considered a "modern" way.

It is not really clear what "retrieve your distributions here" means. I thought it meant "build your distributions" here but in hindsight it probably means use the actions/download-artifact@v4 action to download the already built actions.

[brianmay]

I think these emails I got might help (this is the text/plain component):

PyPI user penguin_brian has removed a trusted publisher from a project
(karaage) that you manage.

Publisher information:

* Publisher: GitHub* Workflow: release-please.yml
* Owner: Karaage-Cluster
* Repository: karaage* Environment:  pypi
If you did not make this change and you think it was made in error, you can
check the "Security history" tab on the project's page.

If you are unable to revert the change and need to do so, you can email
admin@pypi.org to communicate with the PyPI administrators.

And:

PyPI user penguin_brian has added a new trusted publisher to a project
(karaage) that you manage. Trusted publishers act as trusted
users and can create project releases automatically.

Publisher information:

* Publisher: GitHub* Workflow: release-please.yml
* Owner: Karaage-Cluster
* Repository: karaage* Environment: pypi
If you did not make this change and you think it was made maliciously, you can
remove it from the project via the "Publishing" tab on the project's page.

If you are unable to revert the change and need to do so, you can email
admin@pypi.org to communicate with the PyPI administrators.

In the first email, there are two spaces before "pypi", in the second email there is only one space. Might be a whitespace error in the email template, but I am guessing it is indicating that the value itself had an extra whitespace character.

[webknjaz]

Yeah, looks like it. I think it's worth creating an issue over in pypi/warehouse to see how this could be improved.

[brianmay]

Done. pypi/warehouse#17689