Answers: <p>I was only wrapping my PyPI secret token in one pair of curly brackets! Two are required, like</p>
  <p><code>${{ secrets.nmdc_schema_pypi_token }}</code></p>
  
Answers: CC BY-SA 4.0
Answers: 2021-07-30T21:58:11.590Z
Answers: 2021-07-30T21:58:11.590Z
Answers: Mark Miller
Answers: <p>In my case the issue was that I added secrets as &quot;environment secret&quot; rather than &quot;repository secret&quot;, leaving the latter empty.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-08-11T20:19:14.040Z
Answers: 2021-08-11T20:19:14.040Z
Answers: kuropan
Answers: <p>This happened for me in the following circumstances:</p>
  <ul>
  <li>Forked a project in github</li>
  <li>Added a secret for the fork</li>
  <li>Pushed update to my fork, and created a PR</li>
  <li>The PR action ran in the upstream project</li>
  <li>Build failed, with the &quot;does not start with pypi&quot; error</li>
  </ul>
  <p>Instead I created a branch directly in the upstream project (along with the secret token), and when I pushed the branch to the upstream project, it ran as expected and updated TestPyPi.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-10-16T18:17:56.807Z
Answers: 2021-10-16T18:17:56.807Z
Answers: Matthew Hegarty
Body: <p>I am trying to use the <code>pypa/gh-action-pypi-publish</code> action in GitHub to push a Python package to PyPI. I'm in the team that owns <a href="https://github.com/microbiomedata/nmdc-schema" rel="nofollow noreferrer">microbiomedata/nmdc-schema</a> and successfully uses a <a href="https://github.com/microbiomedata/nmdc-schema/blob/main/.github/workflows/pypi-publish.yml" rel="nofollow noreferrer">GitHub action</a> to deploy the <a href="http://https:/https://pypi.org/project/nmdc-schema/" rel="nofollow noreferrer">nmdc-schema</a>. I have also read <a href="https://packaging.python.org/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/" rel="nofollow noreferrer">PyPA's advice</a> and tried to follow it precisely.</p>
  <p>However, when it comes to authenticating against PyPI, I get <a href="https://github.com/turbomam/linkml-template-audit/runs/3145695841?check_suite_focus=true#step:7:24" rel="nofollow noreferrer">this</a> &quot;no matter what I do&quot;</p>
  <pre><code>Run pypa/gh-action-pypi-publish@v1.2.2
    with:
      user: __token__
      password: ${ secrets.pypi_password }
      packages_dir: dist
      verify_metadata: true
    env:
      pythonLocation: /opt/hostedtoolcache/Python/3.8.11/x64
      LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.8.11/x64/lib
  /usr/bin/docker run --name a33c111d135a08e424daf8f55d57f9438a27b_084f0c --label 8a33c1 --workdir /github/workspace --rm -e pythonLocation -e LD_LIBRARY_PATH -e INPUT_USER -e INPUT_PASSWORD -e INPUT_REPOSITORY_URL -e INPUT_PACKAGES_DIR -e INPUT_VERIFY_METADATA -e HOME -e GITHUB_JOB -e GITHUB_REF -e GITHUB_SHA -e GITHUB_REPOSITORY -e GITHUB_REPOSITORY_OWNER -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RETENTION_DAYS -e GITHUB_ACTOR -e GITHUB_WORKFLOW -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GITHUB_EVENT_NAME -e GITHUB_SERVER_URL -e GITHUB_API_URL -e GITHUB_GRAPHQL_URL -e GITHUB_WORKSPACE -e GITHUB_ACTION -e GITHUB_EVENT_PATH -e GITHUB_ACTION_REPOSITORY -e GITHUB_ACTION_REF -e GITHUB_PATH -e GITHUB_ENV -e RUNNER_OS -e RUNNER_TOOL_CACHE -e RUNNER_TEMP -e RUNNER_WORKSPACE -e ACTIONS_RUNTIME_URL -e ACTIONS_RUNTIME_TOKEN -e ACTIONS_CACHE_URL -e GITHUB_ACTIONS=true -e CI=true -v &quot;/var/run/docker.sock&quot;:&quot;/var/run/docker.sock&quot; -v &quot;/home/runner/work/_temp/_github_home&quot;:&quot;/github/home&quot; -v &quot;/home/runner/work/_temp/_github_workflow&quot;:&quot;/github/workflow&quot; -v &quot;/home/runner/work/_temp/_runner_file_commands&quot;:&quot;/github/file_commands&quot; -v &quot;/home/runner/work/linkml-template-audit/linkml-template-audit&quot;:&quot;/github/workspace&quot; 8a33c1:11d135a08e424daf8f55d57f9438a27b  &quot;__token__&quot; &quot;${ secrets.pypi_password }&quot; &quot;&quot; &quot;dist&quot; &quot;true&quot;
  Warning:  It looks like you are trying to use an API token to authenticate in the package index and your token value does not start with &quot;pypi-&quot; as it typically should. This may cause an authentication error. Please verify that you have copied your token properly if such an error occurs.
  Checking dist/linkml_template_audit-0.0.1-py3-none-any.whl: PASSED, with warnings
    warning: `long_description_content_type` missing. defaulting to `text/x-rst`.
  Checking dist/linkml_template_audit-0.0.1.tar.gz: PASSED, with warnings
    warning: `long_description_content_type` missing. defaulting to `text/x-rst`.
  Uploading distributions to https://upload.pypi.org/legacy/
  Uploading linkml_template_audit-0.0.1-py3-none-any.whl
  
    0%|          | 0.00/29.6k [00:00&lt;?, ?B/s]
   27%|██▋       | 8.00k/29.6k [00:00&lt;00:00, 48.7kB/s]
  100%|██████████| 29.6k/29.6k [00:00&lt;00:00, 107kB/s] 
  NOTE: Try --verbose to see response content.
  HTTPError: 403 Forbidden from https://upload.pypi.org/legacy/
  Invalid or non-existent authentication information. See https://pypi.org/help/#invalid-auth for more information.
  </code></pre>
  
Tags: <python><github-actions>
Title: pypa/gh-action-pypi-publish token value 'does not start with "pypi-"'
UserDisplayName: Mark Miller
ThreadText: # pypa/gh-action-pypi-publish token value 'does not start with "pypi-"'
  
  (Asked by: username_0 on 2021-07-23)
  
  I am trying to use the `pypa/gh-action-pypi-publish` action in GitHub to push a Python package to PyPI. I'm in the team that owns [microbiomedata/nmdc-schema](https://github.com/microbiomedata/nmdc-schema) and successfully uses a [GitHub action](https://github.com/microbiomedata/nmdc-schema/blob/main/.github/workflows/pypi-publish.yml) to deploy the [nmdc-schema](http://https:/https://pypi.org/project/nmdc-schema/). I have also read [PyPA's advice](https://packaging.python.org/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/) and tried to follow it precisely.
  
  However, when it comes to authenticating against PyPI, I get [this](https://github.com/turbomam/linkml-template-audit/runs/3145695841?check_suite_focus=true#step:7:24) "no matter what I do"
  
  ```
  Run pypa/gh-action-pypi-publish@v1.2.2
    with:
      user: __token__
      password: ${ secrets.pypi_password }
      packages_dir: dist
      verify_metadata: true
    env:
      pythonLocation: /opt/hostedtoolcache/Python/3.8.11/x64
      LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.8.11/x64/lib
  /usr/bin/docker run --name a33c111d135a08e424daf8f55d57f9438a27b_084f0c --label 8a33c1 --workdir /github/workspace --rm -e pythonLocation -e LD_LIBRARY_PATH -e INPUT_USER -e INPUT_PASSWORD -e INPUT_REPOSITORY_URL -e INPUT_PACKAGES_DIR -e INPUT_VERIFY_METADATA -e HOME -e GITHUB_JOB -e GITHUB_REF -e GITHUB_SHA -e GITHUB_REPOSITORY -e GITHUB_REPOSITORY_OWNER -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RETENTION_DAYS -e GITHUB_ACTOR -e GITHUB_WORKFLOW -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GITHUB_EVENT_NAME -e GITHUB_SERVER_URL -e GITHUB_API_URL -e GITHUB_GRAPHQL_URL -e GITHUB_WORKSPACE -e GITHUB_ACTION -e GITHUB_EVENT_PATH -e GITHUB_ACTION_REPOSITORY -e GITHUB_ACTION_REF -e GITHUB_PATH -e GITHUB_ENV -e RUNNER_OS -e RUNNER_TOOL_CACHE -e RUNNER_TEMP -e RUNNER_WORKSPACE -e ACTIONS_RUNTIME_URL -e ACTIONS_RUNTIME_TOKEN -e ACTIONS_CACHE_URL -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/_temp/_runner_file_commands":"/github/file_commands" -v "/home/runner/work/linkml-template-audit/linkml-template-audit":"/github/workspace" 8a33c1:11d135a08e424daf8f55d57f9438a27b  "__token__" "${ secrets.pypi_password }" "" "dist" "true"
  Warning:  It looks like you are trying to use an API token to authenticate in the package index and your token value does not start with "pypi-" as it typically should. This may cause an authentication error. Please verify that you have copied your token properly if such an error occurs.
  Checking dist/linkml_template_audit-0.0.1-py3-none-any.whl: PASSED, with warnings
    warning: `long_description_content_type` missing. defaulting to `text/x-rst`.
  Checking dist/linkml_template_audit-0.0.1.tar.gz: PASSED, with warnings
    warning: `long_description_content_type` missing. defaulting to `text/x-rst`.
  Uploading distributions to https://upload.pypi.org/legacy/
  Uploading linkml_template_audit-0.0.1-py3-none-any.whl
  
    0%|          | 0.00/29.6k [00:00<?, ?B/s]
   27%|██▋       | 8.00k/29.6k [00:00<00:00, 48.7kB/s]
  100%|██████████| 29.6k/29.6k [00:00<00:00, 107kB/s] 
  NOTE: Try --verbose to see response content.
  HTTPError: 403 Forbidden from https://upload.pypi.org/legacy/
  Invalid or non-existent authentication information. See https://pypi.org/help/#invalid-auth for more information.
  
  ```
  
  **Tags:** python, github-actions
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2021-07-30. Score: 1 | Accepted answer
  
  I was only wrapping my PyPI secret token in one pair of curly brackets! Two are required, like
  
  `${{ secrets.nmdc_schema_pypi_token }}`
  
  
  ---
  
  ### Answer by username_1 on 2021-08-11. Score: 1
  
  In my case the issue was that I added secrets as "environment secret" rather than "repository secret", leaving the latter empty.
  
  
  ---
  
  ### Answer by username_2 on 2021-10-16. Score: 0
  
  This happened for me in the following circumstances:
  
  * Forked a project in github
  * Added a secret for the fork
  * Pushed update to my fork, and created a PR
  * The PR action ran in the upstream project
  * Build failed, with the "does not start with pypi" error
  
  Instead I created a branch directly in the upstream project (along with the secret token), and when I pushed the branch to the upstream project, it ran as expected and updated TestPyPi.
  
  
  ---
  
  