Use twine to upload wheels

[KyleFromNVIDIA]

The gh-action-pypi-publish action is having problems with some repos. Try uploading with twine instead.

[jameslamb]

The gh-action-pypi-publish action is having problems with some repos. Try uploading with twine instead.

What are the problems, specifically? I'd like to know that before reviewing.

[KyleFromNVIDIA]

From https://github.com/rapidsai/pynvjitlink/actions/runs/13730908249/job/38407961979#step:9:106:

/pyenv/versions/3.12.9/bin/python3: can't open file '/home/runner/work/_actions/pypa/gh-action-pypi-publish/release/v1/create-docker-action.py': [Errno 2] No such file or directory

[jameslamb]

Oh. I thought that specific problem was something we thought was related to running on self-hosted runners, and that we thought could be fixed by just switching to the GitHub Actions ubuntu-latest image.

I have one more idea we could try.... could we running pypa/gh-action-pypi-publish on ubuntu-latest and not in a container?

Removing this:

shared-workflows/.github/workflows/wheels-publish.yaml

Lines 51 to 56 in f1fb5d9

	container:
	# CUDA toolkit version of the container is irrelevant in the publish step.
	# This just uploads already-built wheels to remote storage.
	image: "rapidsai/ci-wheel:latest"
	env:
	RAPIDS_BUILD_TYPE: ${{ inputs.build_type }}

And then doing whatever's required to make the relevant bits of gha-tools work outside of one of our CI images.

I just searched around and found some discussion suggesting that this type of issue might be something known and related to how that action sets paths when run in a container:

• Change ${{ github.action_path }} to ${GITHUB_ACTION_PATH} pypa/gh-action-pypi-publish#304
• v1.12 still failing with error similar to #291 pypa/gh-action-pypi-publish#300

[vyasr]

Yes, James is right, see rapidsai/pynvjitlink#132 (comment) most recently.

[KyleFromNVIDIA]

Even if we did move it outside of the container, there are still other issues, like the fact that we're using it from a reusable workflow. I think we should use twine instead.

[webknjaz]

Even if we did move it outside of the container, there are still other issues, like the fact that we're using it from a reusable workflow. I think we should use twine instead.

You can do that at the cost of losing the ability to

1. do tokenless uploads (trusted publishing enables one to get rid of API tokens, so it's less secrets to maintain/scope/rotate)
2. improve the supply chain situation through standardized digital signatures (PEP 740)
3. display more bits of metadata as verified on the public PyPI project page

But even if you go this route, you can still improve security a little bit by storing the in-repo secrets within GitHub Environments scope as opposed to having them repo-global in the settings.

[bdice]

This worked for the pynvjitlink 0.5.2 release! Approving.

[jakirkham]

Deleting publish-wheels-on-github-runners as it is no longer in use

(only pynvjitlink used and it has already switched back to branch-25.04)

Can always restore the branch if needed