diff --git a/oidc-exchange.py b/oidc-exchange.py index 52bee14..f2db5ed 100644 --- a/oidc-exchange.py +++ b/oidc-exchange.py @@ -13,7 +13,7 @@ _GITHUB_STEP_SUMMARY = Path(os.getenv("GITHUB_STEP_SUMMARY")) # The top-level error message that gets rendered. # This message wraps one of the other templates/messages defined below. _ERROR_SUMMARY_MESSAGE = """ -Trusted publisher (OIDC) exchange failure: +Trusted publishing exchange failure: {message} @@ -28,7 +28,7 @@ Read more about trusted publishers at https://docs.pypi.org/trusted-publishers/ # Rendered if OIDC identity token retrieval fails for any reason. _TOKEN_RETRIEVAL_FAILED_MESSAGE = """ -OIDC token retrieval failed: {identity_error} +OpenID Connect token retrieval failed: {identity_error} This generally indicates a workflow configuration error, such as insufficient permissions. Make sure that your workflow has `id-token: write` configured @@ -71,7 +71,7 @@ def die(msg: str) -> NoReturn: with _GITHUB_STEP_SUMMARY.open("a", encoding="utf-8") as io: print(_ERROR_SUMMARY_MESSAGE.format(message=msg), file=io) - print(f"::error::OIDC exchange failure: {msg}", file=sys.stderr) + print(f"::error::trusted publishing exchange failure: {msg}", file=sys.stderr) sys.exit(1) @@ -94,12 +94,14 @@ def assert_successful_audience_call(resp: requests.Response, domain: str): case HTTPStatus.FORBIDDEN: # This index supports OIDC, but forbids the client from using # it (either because it's disabled, limited to a beta group, etc.) - die(f"audience retrieval failed: repository at {domain} has OIDC disabled") + die( + f"audience retrieval failed: repository at {domain} has trusted publishing disabled", + ) case HTTPStatus.NOT_FOUND: # This index does not support OIDC. die( "audience retrieval failed: repository at " - f"{domain} does not indicate OIDC support", + f"{domain} does not indicate trusted publishing support", ) case other: status = HTTPStatus(other) @@ -124,7 +126,7 @@ assert_successful_audience_call(audience_resp, repository_domain) oidc_audience = audience_resp.json()["audience"] -debug(f"selected OIDC token exchange endpoint: {token_exchange_url}") +debug(f"selected trusted publishing exchange endpoint: {token_exchange_url}") try: oidc_token = id.detect_credential(audience=oidc_audience) diff --git a/twine-upload.sh b/twine-upload.sh index f38d429..bf48246 100755 --- a/twine-upload.sh +++ b/twine-upload.sh @@ -44,7 +44,7 @@ if [[ "${INPUT_USER}" == "__token__" && -z "${INPUT_PASSWORD}" ]] ; then # No password supplied by the user implies that we're in the OIDC flow; # retrieve the OIDC credential and exchange it for a PyPI API token. echo \ - '::notice::Attempting to perform OIDC credential exchange' \ + '::notice::Attempting to perform trusted publishing exchange' \ 'to retrieve a temporary short-lived API token for authentication' \ "against ${INPUT_REPOSITORY_URL} due to __token__ username with no" \ 'supplied password field'