Support using a list of tokens about gh-action-pypi-publish HOT 3 CLOSED

There's no way for us to reliably identify if it's one huge password or several tokens. We cannot warn about this.
Also, we just call twine and it does uploading. I'm not even sure if there's an API for verifying that a token is valid.

FWIW this is not a common use case and even if it was, it would be reasonable to define a mapping between the dists and their tokens. Attempting to use a wrong token before the right one would probably alert PyPI too.

To facilitate this, I can only suggest you invoke this action twice, for different package directories and respective tokens.

from gh-action-pypi-publish.

Yes, using it twice was the workaround I went with.

I'm surprised that there's no way to distinguish the two cases. I suppose you would have needed to declare it as a list of strings from the start? Or you'd need a separate "tokenS" parameter.

I didn't expect you to check if the tokens were valid, I expected you to pass them along to twine which would pass them along to pypi which would handle verification. Of course each step along the way could easily have not supported multiple tokens...

from gh-action-pypi-publish.

GHA inputs are arbitrary strings. We'd need to accept a complex structure like JSON to make this work, and maybe force people to escape their secrets. This is not a realistically usable approach and is definitely out of the scope of this action.

from gh-action-pypi-publish.