Auth failure publishing to pypi.org/project/eclipse-zenoh/

Summary

Releasing Eclipse Zenoh 0.7.0-rc we get an Authentication failure when the Github action tries to publish to Pypi.org. See https://github.com/eclipse-zenoh/zenoh-python/actions/runs/3749102379/jobs/6368070748

Warning:  It looks like you are trying to use an API token to authenticate in the package index and your token value does not start with "pypi-" as it typically should. This may cause an authentication error. Please verify that you have copied your token properly if such an error occurs.

...

WARNING  Error during upload. Retry with the --verbose option for more details. 
ERROR    HTTPError: 403 Forbidden from https://upload.pypi.org/legacy/          
         Invalid or non-existent authentication information. See                
         https://pypi.org/help/#invalid-auth for more information.              

The credentials to Pypi.org have been setup in Oct. 2021 via this issue: https://bugs.eclipse.org/bugs/show_bug.cgi?id=576899

Have they changed, or could they have expired ?

Priority

• Urgent
• High
• Medium
• Low

Severity

• Blocker
• Major
• Normal
• Low

Impact

We released Zenoh for all supported languages, except Python. This will lead our Python users to have incompatibilities and errors between their applications and the Zenoh infrastructure.

added IT-priorityhigh IT-severitymajor ~24524 team:releng labels

assigned to @fgurr

• The API token has not been changed and does not seem to be expired.
• The token has the pypi- prefix.

I've re-added the token to the GitHub org secret. Please try again.

Still the same error: https://github.com/eclipse-zenoh/zenoh-python/actions/runs/3749102379/jobs/6369329077

Maybe related to changes in pypa/gh-action-pypi-publish@master which we use for publication. Trying with pypa/gh-action-pypi-publish@release/v1 now.

I've created a new token and added it to the org secret. Please try again.

Same error with the new token:
https://github.com/eclipse-zenoh/zenoh-python/actions/runs/3749102379/jobs/6369446600

Still the same error after upgrading to pypa/gh-action-pypi-publish@v1.6.4 (latest version) !
https://github.com/eclipse-zenoh/zenoh-python/actions/runs/3750214224/jobs/6369942688

The Warning about the token not starting with pypi- still appears, which is really weird! It comes from this code:
https://github.com/pypa/gh-action-pypi-publish/blob/v1.6.4/twine-upload.sh#L21

I understand this $INPUT_PASSWORD variable comes from the ${{ secrets.PYPI_API_TOKEN }}

I tried to build/publish from my fork with my own token (as I'm also owner os eclipse-zenoh on Pypi). But get the exact same issue:
https://github.com/JEnoch/zenoh-python/actions/runs/3750677501/jobs/6371040947

I ended up downloading the produced wheels from Github action and manually publish those with python twine command, still with my own token... and it succeeded !

So, no idea what's going on on Github... if it's an issue with pypa/gh-action-pypi-publish or with Github secrets.
Anyway, I'm closing this ticket since I don't think it's related to the token itself.
Thanks for your support!

closed