"invalid-publisher: valid token, but no corresponding publisher" error, nothing changed on our side

[ryanblock]

Hello there! Regarding this particular error publishing via OIDC I've already read over: #138, #173 (and the lesser relevant #154, #166) and wasn't able to determine a fix in this case.

I don't really have repro steps here, other than:

• Yesterday: OIDC publishing via GitHub Actions worked, I went to sleep
• Today: publishing is no longer working 😅

I didn't change anything on our side, just going about our regular business of committing changes and publishing. Links:

• Last good publish: https://github.com/architect/functions-python/actions/runs/5871320031/job/15920514677
• Today's first publish (failed, retried multiple times): https://github.com/architect/functions-python/actions/runs/5884466680/job/15959785267
• Today's latest publish (still failing): https://github.com/architect/functions-python/actions/runs/5884671963/job/15959902178

Here's the relevant block in our GitHub Actions file jic.

Thanks for your attention! 💕

[webknjaz]

@di @woodruffw could you take a look? The error implies the env check failure, but the workflow doesn't use envs.

[di]

Looking into this now.

[di]

Fix is here: pypi/warehouse#14374

[ryanblock]

Woo, nice job on the quick patch. Re-ran the last failed build, and that build is no longer failing. 💯

[woodruffw]

Hmm, looks like another unexpected claim change on GitHub's part -- I guess environment is now always present with ""?

Edit: Ignore me, I see the change was purely on the Warehouse side with pypi/warehouse#14372.