Using self-hosted runners for publishing about gh-action-pypi-publish HOT 7 CLOSED

I guess, I cannot use my self-hosted runner for Trusted Publishing.

@woodruffw could you look into this? Quick googling suggests that GitHub doesn't limit OIDC to GH-hosted runners but there's a metadata field that can be used to check if it's self-hosted...

Can I use API token instead?

Sure, that's always worked. While it's de-emphasized in the README now, it's still supported: https://github.com/pypa/gh-action-pypi-publish#specifying-a-different-username. Just put it into a repo secret that I still recommend making under a GitHub Environment rather than a repo-global one. Plus, you can make use of the required approvals this way.

from gh-action-pypi-publish.

Alright, looking like there's nothing actionable on our side.

from gh-action-pypi-publish.

The issue was the runner, I managed to publish the package by using github runner runs-on: ubuntu-latest.
I guess, I cannot use my self-hosted runner for Trusted Publishing. Can I use API token instead?

from gh-action-pypi-publish.

I guess, I cannot use my self-hosted runner for Trusted Publishing.

@woodruffw could you look into this? Quick googling suggests that GitHub doesn't limit OIDC to GH-hosted runners but there's a metadata field that can be used to check if it's self-hosted...

Yeah, the relevant field is runner_environment. That being said I don't believe PyPI checks that claim at all, so we should support OIDC identities from self-hosted runners currently (although I have no idea how GitHub produces them internally -- I guess self-hosted runners call back into their IdP infrastructure? That doesn't seem safe to me 🙂)

my publish action get stuck indefenetly waiting for the token:

Unfortunately, this strongly suggests a network hiccup or outage on GitHub's side (or, less likely, PyPI's). I've seen occasional timeouts on OIDC credential retrieval before, and it's possible that self-hosted runners may be more susceptible to them (or that the runner agent doesn't have a timeout in place).

(If the error was due to an invalid token from the self-hosted runner, you would have instead seen a detailed error message from PyPI explaining which claims were invalid.)

from gh-action-pypi-publish.

I tried to use API token, but the upload gets stuck at 0%. Seems, that @woodruffw is right, and there is some connection issues, as the container struggles to send the data to PyPI server. I checked the log but didn't find anything useful.
Job: https://github.com/unipoll/API/actions/runs/6240377666/job/16940353534

I have attached the log from the container, in case anyone is interested.
Guess, I will have to reserve to using GitHub runners for uploading.

@webknjaz, @woodruffw thank you for looking into the issue anyway.
log.txt

from gh-action-pypi-publish.

Does your self-hosted runner happen to be behind a corporate firewall or something similar? Many companies block PyPI; that might be a proximate cause here.

from gh-action-pypi-publish.

I host my runners in the home lab behind OPNsense firewall. I also though that maybe it's the firewall blocking the connection, but after checking the firewall log(while the action was running) I didn't see anything abnormal. There shouldn't be anything blocking the connection. Besides, I am successfully able to run actions to make GitHub releases or build and upload images to Docker Hub. So, I'm not sure whether it's the firewall issue or maybe some services like HAproxy get in the way, or maybe even my internet provider... but I think that would be too difficult for me to investigate, since I'm only learning all these devops stuff. 😃

So we'll have to wait for someone else(more knowledgeable) to confirm whether the are issues running pypi-publish action on self-hosted GitHub Action Runner Controller or it's just my misconfiguration causes the problem.

from gh-action-pypi-publish.