Trusted publishing support for GitHub Actions + TestPyPI via uv publish

[nathanjmcdougall]

Currently, uv publish supports trusted publishing support via GitHub Actions with PyPI, but not with TestPyPI. For testing purposes, it would be great if support could be extended to TestPyPI.

[konstin]

The trusted publishing support exists for both TestPyPI and PyPI, is there anything specific not working?

[nathanjmcdougall]

OK, that's great to hear, I guess in that case I just haven't worked out how to set up trusted publishing properly yet. I'm experimenting here:
https://github.com/nathanjmcdougall/postmodern-python-ci/blob/main/.github/workflows/release.yml

I get errors about missing credentials:

error: Failed to publish dist/postmodern_ci-0.1.0-py3-none-any.whl to https://upload.test.pypi.org/legacy/
Caused by: Failed to send POST request
Caused by: Missing credentials for https://upload.test.pypi.org/legacy/

My TestPyPI config is here:

I don't actually know where the TestPyPI upload endpoint is, I've tried manually using API tokens but I get the following:

• https://test.upload.pypi.org/legacy/ -> dns error: No such host is known. (os error 11001)
• https://upload.test.pypi.org/legacy/ -> dns error: No such host is known. (os error 11001)
• https://upload.pypi.org/legacy/ ->Permission denied (status code 403 Forbidden)

Probably I need to do more work to diagnose my issue, so I'm closing for now. Any support appreciated but not expected.

[konstin]

The publish endpoint for TestPyPI is https://test.pypi.org/legacy/

[konstin]

To help with debugging trusted publishing, I recommend uv publish --trusted-publishing always, this will show errors earlier when there is a problem.

[nathanjmcdougall]

Thanks, great to know the endpoint and the suggestion to --trusted-publishing was also helpful. The message I got was:

error: Failed to obtain token for trusted publishing
Caused by: environment variable not found

This was a tad cryptic without knowing the ins-and-outs of trusted publishing, but the issue was that I had not set id-token write permission, as described here. Once this was set, everything worked.

Thank you so much for your help.