@@ -47,6 +47,31 @@ def get_normalized_input(name: str) -> str | None:
47
47
return os .getenv (name .replace ("-" , "_" ))
48
48
49
49
50
+ def assert_successful_audience_call (resp : requests .Response , domain : str ):
51
+ if resp .ok :
52
+ return
53
+
54
+ match resp .status_code :
55
+ case 403 :
56
+ # This index supports OIDC, but forbids the client from using
57
+ # it (either because it's disabled, ratelimited, etc.)
58
+ die (f"audience retrieval failed: repository at { domain } has OIDC disabled" )
59
+ case 404 :
60
+ # This index does not support OIDC.
61
+ die (
62
+ "audience retrieval failed: repository at "
63
+ f"{ domain } does not indicate OIDC support"
64
+ )
65
+ case other :
66
+ # Unknown: the index may or may not support OIDC, but didn't respond with
67
+ # something we expect. This can happen if the index is broken, in maintenance mode,
68
+ # misconfigured, etc.
69
+ die (
70
+ "audience retrieval failed: repository at "
71
+ f"{ domain } responded with unexpected { other } "
72
+ )
73
+
74
+
50
75
repository_url = get_normalized_input ("repository-url" )
51
76
if not repository_url :
52
77
# Easy case: no explicit repository URL, which means we're using PyPI and we can just
@@ -61,28 +86,7 @@ def get_normalized_input(name: str) -> str | None:
61
86
# which tells OIDC exchange clients which audience to use.
62
87
audience_url = f"https://{ repository_domain } /_/oidc/audience"
63
88
audience_resp = requests .get (audience_url )
64
-
65
- if not audience_resp .ok :
66
- if audience_resp .status_code == 403 :
67
- # This index supports OIDC, but forbids the client from using
68
- # it (either because it's disabled, ratelimited, etc.)
69
- die (
70
- f"audience retrieval failed: repository at { repository_domain } has OIDC disabled"
71
- )
72
- elif audience_resp .status_code == 404 :
73
- # This index does not support OIDC.
74
- die (
75
- "audience retrieval failed: repository at "
76
- f"{ repository_domain } does not indicate OIDC support"
77
- )
78
- else :
79
- # Unknown: the index may or may not support OIDC, but didn't respond with
80
- # something we expect. This can happen if the index is broken, in maintenance mode,
81
- # misconfigured, etc.
82
- die (
83
- "audience retrieval failed: repository at "
84
- f"{ repository_domain } responded with unexpected { audience_resp .status_code } "
85
- )
89
+ assert_successful_audience_call (audience_resp , repository_domain )
86
90
87
91
oidc_audience = audience_resp .json ()["audience" ]
88
92
0 commit comments