`invalid-publisher`: valid token, but no corresponding publisher

[eifinger]

Hi,
I have a release workflow which suddenly stopped working:

• First run worked
• Second run failed because I tried to upload the same version number by accident
• Third run for a new version number shows invalid-publisher: valid token, but no corresponding publisher

Aside the version numbers I did not change anything.
I also tried to remove the trusted publisher and add it again and rerun the action but still no success.

What could be the reason that this worked the first time but not since then?

[webknjaz]

Sounds like a warehouse problem... @di @woodruffw could you look into this?

[webknjaz]

I tried to upload the same version number by accident

This wouldn't be related.

[webknjaz]

I also tried to remove the trusted publisher and add it again and rerun the action but still no success.

Was this right before the third run? Maybe, you made a typo somewhere and repo or env doesn't match?

[di]

Looks like your publisher is configured with an environment:

warehouse=> select * from github_oidc_publishers where repository_name = 'pywaze';
 repository_name | repository_owner | repository_owner_id | workflow_filename |                  id                  | environment
-----------------+------------------+---------------------+-------------------+--------------------------------------+-------------
 pywaze          | eifinger         | 1481961             | release.yml       | b5d2c695-2a19-417a-93ea-99ef38686566 | pypi
(1 row)

but I don't see that environment listed anywhere here: https://github.com/eifinger/pywaze/blob/main/.github/workflows/release.yml

I would expect to see something like environment: pypi listed in the workflow as documented here: https://docs.pypi.org/trusted-publishers/using-a-publisher/

Unfortunately I can't see how your original publisher was configured, did it have an environment set?

[eifinger]

I also tried to remove the trusted publisher and add it again and rerun the action but still no success.

Was this right before the third run? Maybe, you made a typo somewhere and repo or env doesn't match?

The third run has 3 attempts. I readded the publisher between the 2nd and 3rd attempt

[eifinger]

Looks like your publisher is configured with an environment:

warehouse=> select * from github_oidc_publishers where repository_name = 'pywaze';
 repository_name | repository_owner | repository_owner_id | workflow_filename |                  id                  | environment
-----------------+------------------+---------------------+-------------------+--------------------------------------+-------------
 pywaze          | eifinger         | 1481961             | release.yml       | b5d2c695-2a19-417a-93ea-99ef38686566 | pypi
(1 row)

but I don't see that environment listed anywhere here: https://github.com/eifinger/pywaze/blob/main/.github/workflows/release.yml

I would expect to see something like environment: pypi listed in the workflow as documented here: https://docs.pypi.org/trusted-publishers/using-a-publisher/

Unfortunately I can't see how your original publisher was configured, did it have an environment set?

I had some issues with GitHub in the last weeks showing different commits on some branches in different sessions. For me the environment is visible on line 13: https://github.com/eifinger/pywaze/blob/main/.github/workflows/release.yml#L13

[woodruffw]

Hmm, I can see the environment configured on the tag's changes as well:

https://github.com/eifinger/pywaze/blob/7a468b8d646d4ae0a07c13582e64d3bd5e0234e5/.github/workflows/release.yml

It's possible this was some kind of weird hiccup on GitHub's side, given the inconsistent results that people are seeing for the workflow's contents. Could you try running your release workflow again?

[di]

Ah, sorry, looks like I just can't read 😂

[eifinger]

Hmm, I can see the environment configured on the tag's changes as well:

https://github.com/eifinger/pywaze/blob/7a468b8d646d4ae0a07c13582e64d3bd5e0234e5/.github/workflows/release.yml

It's possible this was some kind of weird hiccup on GitHub's side, given the inconsistent results that people are seeing for the workflow's contents. Could you try running your release workflow again?

Attempt 4 failed as well https://github.com/eifinger/pywaze/actions/runs/5794194719/job/15724456812

[woodruffw]

Dang, thanks for trying.

Everything looks like to me here, and it's strange that it worked the first time but not the others. Could you share a screencap of the security event for the successful publish? It should be 1-2 events in the "Security History" page for the project that look something like this:

[eifinger]

Thank you for the fast and nice responses btw!

[woodruffw]

Thanks! Just for our reference, here's the workflow from that successful publish:

https://github.com/eifinger/pywaze/blob/bc8f7470f10691351cbe47a46ab71995b82e9cfb/.github/workflows/release.yml

This is pretty strange -- I don't see anything salient between that successful publish and the workflow that's failing 😕

[di]

The only thing that changed is that this was likely converted from a pending publisher to a regular publisher, so something doesn't agree in the publisher queries/verification between the two.

I'm working on adding some better error messages here (there are a lot of failure modes that would result in this one error message) which should at least help narrow this down.

[di]

@woodruffw The changes in question are here: pypi/warehouse#14308.

@eifinger Sorry you're having trouble here. Could I kindly ask that you don't change anything with your setup here for the time being? We should be able to ship this change shortly after which we can re-run your workflow to get some additional details on why this is failing.

[eifinger]

Doing nothing? Yeah I think I can handle that 😄