New automation for publishing to PyPI

[chreekat]

Background

Publishing ptf to PyPi is already fairly automated, as documented at README-publish-python-package.md.

However, the automation competes with the similar "Publish Release" automation, which creates a "Release" (https://github.com/p4lang/ptf/releases) on GitHub. They work in slightly overlapping ways, and the existing PyPI documentation fails to account for Version.txt being the single source of truth for the version number.

I'm opening this issue to discuss a new way of doing things.

Proposed PyPI automation

1. Fold PyPI publishing into the same workflow as GitHub publishing

The main benefit is that both types of publishing get triggered by the same thing. Namely, changes to Version.txt. This ensures they have the same source of truth.

2. Use OIDC-based authentication with PyPI

This is a new and nicer option for sharing trust between PyPI and our workflow.

It requires configuring PyPI as described in the linked documents. It would also be good to add a "PyPI" environment to this repo.

• https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-in-pypi
• https://docs.pypi.org/trusted-publishers/

Once done, we can remove the PYPI_API_TOKEN secret from this repo (yay)

3. Clean up or remove the README-publish-python-package.md

ptf will be automatically published to PyPI any time Version.txt is changed. If there are no manual steps, there's no process to document separately. Of course, the automation may still be documented somewhere.

Note

With environments, it is possible to still require manual approval before publishing a release on PyPI, if that's desired.

Alternatives

Keeping PyPI publishing in a separate workflow may have some benefit, if there's any reason whatsoever to publish on a different frequency than how we publish releases on GitHub.

[chreekat]

I've implemented steps 1 and 2 here: 078e4d6

[fruffy]

This is nice. Let's go with it. This does not require any secrets or setup?

[chreekat]

On rereading my description, I realized I buried two necessary setup steps. It's much clearer in the docs I linked. :D
In short,

1. someone with access to the PyPI side of things needs to enable GitHub as an OIDC partner
2. Someone with maintainer or admin privileges needs to create a pypi Environment on this GitHub repo.

[fruffy]

@michellearoth We should ask Antonin for the credentials on pypi and hand them over to P4lang.

https://pypi.org/user/AntoninBas/
These should all be part of P4lang.

[jafingerhut]

I have sent Antonin a personal email on this topic, pointing him at this conversation.

If the pypi.org account being used is one personally created by Antonin, perhaps the best approach is to create a new P4.org account on pypi.org and use that instead?

[chreekat]

The results of the email thread were promising -- I'm happy to continue once the org and access are sorted out.