5
5
from typing import NoReturn
6
6
from urllib .parse import urlparse
7
7
8
- import id # noqa: W0622
8
+ import id # pylint: disable= W0622
9
9
import requests
10
10
11
11
_GITHUB_STEP_SUMMARY = Path (os .getenv ("GITHUB_STEP_SUMMARY" ))
12
12
13
- _TOKEN_RETRIEVAL_FAILED_MESSAGE = dedent ("""
13
+ _TOKEN_RETRIEVAL_FAILED_MESSAGE = dedent (
14
+ """
14
15
OIDC token retrieval failed: {identity_error}
15
16
16
17
This generally indicates a workflow configuration error, such as insufficient
21
22
permissions:
22
23
id-token: write
23
24
```
24
- """
25
+ """ ,
25
26
)
26
27
27
28
@@ -31,7 +32,8 @@ def die(msg: str) -> NoReturn:
31
32
32
33
# NOTE: `msg` is Markdown formatted, so we emit only the header line to
33
34
# avoid clogging the console log with a full Markdown formatted document.
34
- print (f"::error::OIDC exchange failure: { msg .splitlines ()[0 ]} " , file = sys .stderr )
35
+ header = msg .splitlines ()[0 ]
36
+ print (f"::error::OIDC exchange failure: { header } " , file = sys .stderr )
35
37
sys .exit (1 )
36
38
37
39
@@ -59,20 +61,20 @@ def assert_successful_audience_call(resp: requests.Response, domain: str):
59
61
# This index does not support OIDC.
60
62
die (
61
63
"audience retrieval failed: repository at "
62
- f"{ domain } does not indicate OIDC support"
64
+ f"{ domain } does not indicate OIDC support" ,
63
65
)
64
66
case other :
65
67
# Unknown: the index may or may not support OIDC, but didn't respond with
66
68
# something we expect. This can happen if the index is broken, in maintenance mode,
67
69
# misconfigured, etc.
68
70
die (
69
71
"audience retrieval failed: repository at "
70
- f"{ domain } responded with unexpected { other } "
72
+ f"{ domain } responded with unexpected { other } " ,
71
73
)
72
74
73
75
74
76
repository_url = get_normalized_input ("repository-url" )
75
- if not repository_url :
77
+ if not repository_url : # noqa: WPS504
76
78
# Easy case: no explicit repository URL, which means we're using PyPI and we can just
77
79
# hardcode the exchange endpoint and OIDC audience.
78
80
token_exchange_url = "https://pypi.org/_/oidc/github/mint-token"
@@ -109,14 +111,15 @@ def assert_successful_audience_call(resp: requests.Response, domain: str):
109
111
# Token exchange failure normally produces a JSON error response, but
110
112
# we might have hit a server error instead.
111
113
die (
112
- dedent (f"""
114
+ dedent (
115
+ f"""
113
116
Token request failed: the index produced an unexpected
114
117
{ mint_token_resp .status_code } response.
115
118
116
119
This strongly suggests a server configuration or downtime issue; wait
117
120
a few minutes and try again.
118
- """
119
- )
121
+ """ ,
122
+ ),
120
123
)
121
124
122
125
reasons = "\n " .join (
@@ -125,24 +128,26 @@ def assert_successful_audience_call(resp: requests.Response, domain: str):
125
128
)
126
129
127
130
# NOTE: Can't `dedent(...)` here because `reasons` is newline-delimited.
128
- die (f"""
131
+ die (
132
+ f"""
129
133
Token request failed: the server refused the request for the following reasons:
130
134
131
135
{ reasons }
132
- """
136
+ """ ,
133
137
)
134
138
135
139
mint_token_payload = mint_token_resp .json ()
136
140
pypi_token = mint_token_payload .get ("token" )
137
141
if pypi_token is None :
138
142
die (
139
- dedent ("""
143
+ dedent (
144
+ """
140
145
Token response error: the index gave us an invalid response.
141
146
142
147
This strongly suggests a server configuration or downtime issue; wait
143
148
a few minutes and try again.
144
- """
145
- )
149
+ """ ,
150
+ ),
146
151
)
147
152
148
153
# Mask the newly minted PyPI token, so that we don't accidentally leak it in logs.
0 commit comments