Fix the "Publish to PyPI" workflow

[seisman]

See #3691 (comment) for details.

Generally speaking, we have the following options:

• Set attestations: false Producing attestations fails when attempting publishing from unsupported reusable workflows (when enabled) pypa/gh-action-pypi-publish#283 (comment)
• Use separate jobs for the TestPyPI and PyPI uploads: Producing attestations fails when attempting publishing from unsupported reusable workflows (when enabled) pypa/gh-action-pypi-publish#283 (comment)
• Disable TestPyPI uploads for releases.

I think we should go for option 2, since it is recommended in the official packaging guides at https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#separate-workflow-for-publishing-to-testpypi

[weiji14]

Agree with option 2, even though it's a bit more work to rewrite the workflow. Could you also remove the 'Temporary token for PyGMT' used for the PyGMT v0.14.0 release?

[seisman]

Could you also remove the 'Temporary token for PyGMT' used for the PyGMT v0.14.0 release?

Did you remove it already?

[weiji14]

Could you also remove the 'Temporary token for PyGMT' used for the PyGMT v0.14.0 release?

Did you remove it already?

No, I don't think I can remove it since you created it.

[weiji14]

Originally posted by @seisman in #3691 (comment)

We need to decide what to do with the workflow, but before that we need to decide what to do with v0.14.0 release. We can either manually upload v0.14.0 to PyPI or have a v0.14.1 release after fixing the workflow.

I've decided to manually upload v0.14.0 following instructions at https://packaging.python.org/en/latest/guides/distributing-packages-using-setuptools/#packaging-your-project. Now v0.14.0 is on PyPI.

Btw, it looks like the manual PyPI upload at https://pypi.org/project/pygmt/0.14.0/#pygmt-0.14.0-py3-none-any.whl is bigger (428.4 kB) than the one on TestPyPI at https://test.pypi.org/project/pygmt/#pygmt-0.14.0-py3-none-any.whl (290.1 kB) for PyGMT v0.14.0:

TestPyPI	PyPI

Looking inside the pygmt-0.14.0-py3-none-any.whl file, it seems that the tests/ folder was included in the manual PyPI upload, hence the size difference. Is running make package not excluding test files again (xref #2956)?

[seisman]

Could you also remove the 'Temporary token for PyGMT' used for the PyGMT v0.14.0 release?

Did you remove it already?

No, I don't think I can remove it since you created it.

I can't see the token now. Maybe I've removed it after uploading the release?

[seisman]

Looking inside the pygmt-0.14.0-py3-none-any.whl file, it seems that the tests/ folder was included in the manual PyPI upload, hence the size difference. Is running make package not excluding test files again (xref #2956)?

Just tried to run make package locally. The wheel doesn't have the tests folder. Not sure what was happening.

[weiji14]

Looking inside the pygmt-0.14.0-py3-none-any.whl file, it seems that the tests/ folder was included in the manual PyPI upload, hence the size difference. Is running make package not excluding test files again (xref #2956)?

Just tried to run make package locally. The wheel doesn't have the tests folder. Not sure what was happening.

Yeah, I get the same on my side running make package locally, so wondering if you were doing something differently. That's ok though, we'll just make sure the auto upload works next time for PyGMT v0.15.0.

[weiji14]

FYI, I received an email about constraining Trusted Publisher to the testpypi environment only

A Trusted Publisher for project pygmt was just used from a CI/CD job configured with a GitHub environment. The environment used was: testpypi.

Since the Trusted Publisher is configured to allow any environment, for security reasons we recommend constraining it to only one.

If you are an owner of this project, you can automatically constrain this Trusted Publisher to 'testpypi' by following this link: constrain publisher (link retracted).

Alternatively, you can do this manually by going to the project's publishing settings, deleting the existing Trusted Publisher and creating a new one with the environment set to 'testpypi'.

I've applied the changes, so pushes to TestPyPI can only take place from the testpypi environment. There might be a similar email for PyPI when the next release happens.