pymc-nightly upload fails with auth error

[twiecki]

arning:  It looks like you are trying to use an API token to authenticate in the package index and your token value does not start with "pypi-" as it typically should. This may cause an authentication error. Please verify that you have copied your token properly if such an error occurs.
[14](https://github.com/pymc-devs/pymc/runs/5429643692?check_suite_focus=true#step:7:14)
Checking dist/pymc-nightly-4.0.0b2.dev20220305.tar.gz: PASSED
[15](https://github.com/pymc-devs/pymc/runs/5429643692?check_suite_focus=true#step:7:15)
Uploading distributions to https://upload.pypi.org/legacy/
[16](https://github.com/pymc-devs/pymc/runs/5429643692?check_suite_focus=true#step:7:16)
Uploading pymc-nightly-4.0.0b2.dev20220305.tar.gz
[17](https://github.com/pymc-devs/pymc/runs/5429643692?check_suite_focus=true#step:7:17)

[18](https://github.com/pymc-devs/pymc/runs/5429643692?check_suite_focus=true#step:7:18)
  0%|          | 0.00/531k [00:00<?, ?B/s]
[19](https://github.com/pymc-devs/pymc/runs/5429643692?check_suite_focus=true#step:7:19)
 30%|███       | 160k/531k [00:00<00:00, 1.58MB/s]
[20](https://github.com/pymc-devs/pymc/runs/5429643692?check_suite_focus=true#step:7:20)
100%|██████████| 531k/531k [00:00<00:00, 2.39MB/s]
[21](https://github.com/pymc-devs/pymc/runs/5429643692?check_suite_focus=true#step:7:21)
Error during upload. Retry with the --verbose option for more details.
[22](https://github.com/pymc-devs/pymc/runs/5429643692?check_suite_focus=true#step:7:22)
HTTPError: 403 Forbidden from https://upload.pypi.org/legacy/
[23](https://github.com/pymc-devs/pymc/runs/5429643692?check_suite_focus=true#step:7:23)
Invalid or non-existent authentication information. See https://pypi.org/help/#invalid-auth for more information.

CC @fonnesbeck @theorashid

[theorashid]

To isolate this issue, I'm assuming it's to do with the lines in nightly.yml

- name: Publish to PyPI
  uses: pypa/[email protected]
  with:
    user: __token__
    password: ${{ secrets.nightly_pypi_secret }}

which I copied over from the aesara equivalent file.

I'm not sure I'll be able to help much fixing this, given my permissions, but this page explains how this github action works.

And I suppose the answer is on this thread:

Once you create your API token on PyPI, you can paste it in the secrets tab of your repository as a new token. Then, whatever NAME you give that token is used in the python-publish.yml file as ${{secrets.NAME}}. In this case, it’s PYPI_API_TOKEN. Does that help?

[twiecki]

What's your pypi user name?

…

On Sat, Mar 5, 2022 at 12:24 PM theorashid ***@***.***> wrote: To isolate this issue, I'm assuming it's to do with the lines in nightly.yml - name: Publish to PyPI uses: ***@***.*** with: user: __token__ password: ${{ secrets.nightly_pypi_secret }} which I copied over from the aesara equivalent file. I'm not sure I'll be able to help much fixing this, given my permissions, but this page <https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/> explains how this github action works. And I suppose the answer is on this thread <https://github.community/t/pypi-api-token-invalid/191552>: Once you create your API token on PyPI, you can paste it in the secrets tab of your repository as a new token. Then, whatever NAME you give that token is used in the python-publish.yml file as ${{secrets.NAME}}. In this case, it’s PYPI_API_TOKEN. Does that help? — Reply to this email directly, view it on GitHub <#5548 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFETGBWHVZTS6JLDDENB43U6M75ZANCNFSM5P7QNH2A> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[fonnesbeck]

Incase this is helpful:

[theorashid]

What's your pypi user name?

I don't think I'll be able to fix it because I can't access the secrets tab in the repository settings

[ghost]

OK, I created a secret called PYPI_TOKEN_PYMC_NIGHTLY corresponding to the PyPI token for uploading to pymc-nightly.

[twiecki]

Someone just tried this successfully 🥳