Publish: Password requires username

[konstin]

You can't use a password without a username in uv publish, which we can catch in clap directly.

New error when using only a password:

$ uv publish --password dummy
error: the following required arguments were not provided:
  --username <USERNAME>

Usage: uv.exe publish --username <USERNAME> --password <PASSWORD> [FILES]...

For more information, try '--help'.

Fixes #8023

[charliermarsh]

This looks like a good change, but I'm still wondering if we can guide people to success here. Can we add a custom hint about tokens?

[konstin]

What about adding it in the docstring of --password?

[zanieb]

It would probably be best to include the hint in the error message, which would mean checking later manually instead of using Clap.

The short help won't show it if it's in the docstring.

[charliermarsh]

Yeah can we just add a hint when we see Failed to publish... with a password but no username? You can even use Miette if you want to make it a bit easier to render the hint. See crates/uv/src/commands/diagnostics.rs for an example.

[zanieb]

I think actually some indexes don't even require a username, just a password — this was an annoyance with twine in packse where I was forced to provide a dummy username — so we probably shouldn't enforce this until there's a failure?

[konstin]

Do you have an example for such an index?

[charliermarsh]

@konsti -- Is there any objection to adding a real hint to the error trace? Can we just do that?

[charliermarsh]

@konstin -- What about Zanie's concern above? I thought the conversation was veering towards only showing this when we hit a failure.

[charliermarsh]

I think we should suggest --user and --token, and note the env vars since it's common in GHA:

Attempted to publish with a password, but no username. Either provide a username with --user (UV_PUBLISH_USERNAME), or use --token (UV_PUBLISH_TOKEN) in lieu of a password.

[konstin]

This case only appears when you use only a password and not a username, despite token vs username/password are clearly documented in the pypi docs and our docs, and other indexes that i have tested providing clear guidance on username and password values. This is a fringe case and I'd rather spend our efforts on more impactful UX aspects, such as showing good messages after 403 errors, guiding users to the correct github actions trusted publishing settings, skip-existing/retries, etc.

[konstin]

I thought the concern was that we should tell users about tokens?

We definitely can't support password-only without an example of an index and how that index would encode this in the HTTP message, the current serialization always requires a username.

[charliermarsh]

Maybe @zanieb can provide an example then. If it's true then this could break users as-is.

[konstin]

There may be other use cases we need to support, but it is not a regression due to:

uv/crates/uv-publish/src/lib.rs

Line 541 in 01c44af

if let (Some(username), Some(password)) = (username, password) {