Add support for verbose bash execusion w/ $DEBUG

This patch imports the system-global profile script to
populate the `$PATH` variable with the typically available binary
paths.

Ref:
https://github.com/pypa/gh-action-pypi-publish/issues/112#issuecomment-1340065840

.github/FUNDING.yml

@@ -1,6 +1,16 @@
-github: [webknjaz]
-patreon: webknjaz
-# open_collective: # Replace with a single Open Collective username
+---
+
+custom:
+- https://www.comebackalive.in.ua/donate
+- https://github.com/vshymanskyy/StandWithUkraine#for-maintainers-and-authors
+- https://www.paypal.me/webknjazCZ
+- https://webknjaz.me
+
+github:
+- webknjaz
+
 ko_fi: webknjaz
-# tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
-custom: https://www.paypal.me/webknjazCZ
+
+liberapay: webknjaz
+
+...

.github/workflows/self-smoke-test-action.yml

@@ -0,0 +1,95 @@
+---
+
+name: 🧪
+
+on:   # yamllint disable-line rule:truthy
+  push:
+  pull_request:
+
+env:
+  devpi-password: abcd1234
+  devpi-username: root
+  devpi-port: 3141
+
+  FORCE_COLOR: 1  # Request colored output from CLI tools supporting it
+  MYPY_FORCE_COLOR: 1  # MyPy's color enforcement
+  PIP_DISABLE_PIP_VERSION_CHECK: 1
+  PIP_NO_PYTHON_VERSION_WARNING: 1
+  PIP_NO_WARN_SCRIPT_LOCATION: 1
+  PY_COLORS: 1  # Recognized by the `py` package, dependency of `pytest`
+  TOX_PARALLEL_NO_SPINNER: 1
+  TOX_TESTENV_PASSENV: >-  # Make tox-wrapped tools see color requests
+    FORCE_COLOR
+    MYPY_FORCE_COLOR
+    NO_COLOR
+    PY_COLORS
+    PYTEST_THEME
+    PYTEST_THEME_MODE
+
+jobs:
+  smoke-test:
+    runs-on: ubuntu-latest
+
+    services:
+      devpi:
+        image: muccg/devpi
+        env:
+          DEVPI_PASSWORD: ${{ env.devpi-password }}
+        ports:
+        - 3141
+
+    timeout-minutes: 2
+
+    steps:
+    - name: Check out the action locally
+      uses: actions/checkout@v3
+      with:
+        path: test
+    - name: Install the packaging-related tools
+      run: python3 -m pip install build twine
+      env:
+        PIP_CONSTRAINT: test/requirements/runtime.txt
+    - name: Create the stub package importable directory
+      run: mkdir -pv src/test_package
+    - name: Populate the stub package `__init__.py`
+      run: echo '__version__ = "0.1"' > src/test_package/__init__.py
+    - name: Populate the stub package `README.md`
+      run: echo "# Test Package" > README.md
+    - name: Populate the stub package `pyproject.toml`
+      run: echo "$CONTENTS" > pyproject.toml
+      env:
+        CONTENTS: |
+          [build-system]
+          requires = [
+            "setuptools == 65.6.3",
+          ]
+          build-backend = "setuptools.build_meta"
+
+          [project]
+          name = "test-package"
+          version = "0.1"
+          readme = "README.md"
+    - name: Build the stub package sdist and wheel distributions
+      run: python3 -m build
+    - name: Register the stub package in devpi
+      run: twine register dist/*.tar.gz
+      env:
+        TWINE_USERNAME: ${{ env.devpi-username }}
+        TWINE_PASSWORD: ${{ env.devpi-password }}
+        TWINE_REPOSITORY_URL: >-
+          http://localhost:${{
+            job.services.devpi.ports[env.devpi-port]
+          }}/${{
+            env.devpi-username
+          }}/public/
+    - name: ✅ Smoke-test the locally checked out action
+      uses: ./test
+      env:
+        PATH: utter-nonsense
+      with:
+        user: ${{ env.devpi-username }}
+        password: ${{ env.devpi-password }}
+        repository_url: >-
+          http://devpi:${{ env.devpi-port }}/${{ env.devpi-username }}/public/
+
+...

.pre-commit-config.yaml

@@ -0,0 +1,181 @@
+---
+ci:
+  autoupdate_schedule: quarterly
+
+repos:
+- repo: https://github.com/asottile/add-trailing-comma.git
+  rev: v2.3.0
+  hooks:
+  - id: add-trailing-comma
+
+- repo: https://github.com/PyCQA/isort.git
+  rev: 5.10.1
+  hooks:
+  - id: isort
+    args:
+    - --honor-noqa
+
+- repo: https://github.com/Lucas-C/pre-commit-hooks.git
+  rev: v1.3.1
+  hooks:
+  - id: remove-tabs
+
+- repo: https://github.com/python-jsonschema/check-jsonschema.git
+  rev: 0.18.3
+  hooks:
+  - id: check-github-actions
+  - id: check-github-workflows
+  - id: check-jsonschema
+    name: Check GitHub Workflows set timeout-minutes
+    args:
+    - --builtin-schema
+    - github-workflows-require-timeout
+    files: ^\.github/workflows/[^/]+$
+    types:
+    - yaml
+  - id: check-readthedocs
+
+- repo: https://github.com/pre-commit/pre-commit-hooks.git
+  rev: v4.3.0
+  hooks:
+  # Side-effects:
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
+  - id: mixed-line-ending
+  # Non-modifying checks:
+  - id: name-tests-test
+    files: >-
+      ^tests/[^_].*\.py$
+  - id: check-added-large-files
+  - id: check-byte-order-marker
+  - id: check-case-conflict
+  - id: check-executables-have-shebangs
+  - id: check-merge-conflict
+  - id: check-json
+  - id: check-symlinks
+  - id: check-yaml
+  - id: detect-private-key
+  # Heavy checks:
+  - id: check-ast
+  - id: debug-statements
+    language_version: python3
+
+- repo: https://github.com/codespell-project/codespell
+  rev: v2.2.1
+  hooks:
+  - id: codespell
+
+- repo: https://github.com/adrienverge/yamllint.git
+  rev: v1.28.0
+  hooks:
+  - id: yamllint
+    files: \.(yaml|yml)$
+    types:
+    - file
+    - yaml
+    args:
+    - --strict
+
+- repo: https://github.com/PyCQA/flake8.git
+  rev: 6.0.0
+  hooks:
+  - id: flake8
+    alias: flake8-no-wps
+    name: flake8 WPS-excluded
+    args:
+    - --ignore
+    - >-
+      D100,
+      D101,
+      D103,
+      D107,
+      E402,
+      E501,
+    additional_dependencies:
+    - flake8-2020 ~= 1.7.0
+    - flake8-pytest-style ~= 1.6.0
+    language_version: python3
+
+- repo: https://github.com/PyCQA/flake8.git
+  # NOTE: This is kept at v4 for until WPS starts supporting flake v5.
+  rev: 4.0.1  # enforce-version: 4.0.1
+  hooks:
+  - id: flake8
+    alias: flake8-only-wps
+    name: flake8 WPS-only
+    args:
+    - --ignore
+    - >-
+      WPS102,
+      WPS110,
+      WPS111,
+      WPS305,
+      WPS347,
+      WPS360,
+      WPS421,
+      WPS422,
+      WPS432,
+      WPS433,
+      WPS437,
+      WPS440,
+      WPS441,
+      WPS453,
+    - --select
+    - WPS
+    additional_dependencies:
+    - wemake-python-styleguide ~= 0.16.1
+    language_version: python3
+
+- repo: https://github.com/PyCQA/pylint.git
+  rev: v2.15.3
+  hooks:
+  - id: pylint
+    args:
+    - --disable
+    - >-
+      import-error,
+      invalid-name,
+      line-too-long,
+      missing-class-docstring,
+      missing-function-docstring,
+      missing-module-docstring,
+      protected-access,
+      super-init-not-called,
+      unused-argument,
+      wrong-import-position,
+    - --output-format
+    - colorized
+
+- repo: local
+  hooks:
+  - id: enforced-flake8-version
+    name: Verify that enforced flake8 version stays unchanged
+    description: >-
+      This is a sanity check and fixer that makes sure that
+      the `flake8` version in this file remains matching the
+      corresponding request in the `# enforce-version` comment.
+    # Using Python here because using
+    # shell test does not always work in CIs:
+    entry: >-
+      python -c 'import pathlib, re, sys;
+      pre_commit_config = pathlib.Path(sys.argv[1]);
+      cfg_txt = pre_commit_config.read_text();
+      new_cfg_txt = re.sub(
+      r"(?P<spaces>\s+)rev:\s(?:\d+\.\d+\.\d+)\s{0,2}"
+      r"#\senforce-version:\s(?P<enforced_version>\d+\.\d+\.\d+)"
+      r"[ \t\f\v]*",
+      r"\g<spaces>rev: \g<enforced_version>  "
+      r"# enforce-version: \g<enforced_version>",
+      cfg_txt,
+      );
+      cfg_txt != new_cfg_txt and
+      pre_commit_config.write_text(new_cfg_txt)
+      '
+    pass_filenames: true
+    language: system
+    files: >-
+      ^\.pre-commit-config\.ya?ml$
+    types:
+    - yaml
+
+...

.yamllint

@@ -1,2 +1,10 @@
-indentation:
-  indent-sequences: false
+---
+
+extends: default
+
+rules:
+  indentation:
+    level: error
+    indent-sequences: false
+
+...

Dockerfile

@@ -1,4 +1,4 @@
-FROM python:3.9-slim
+FROM python:3.11-slim
 
 LABEL "maintainer" "Sviatoslav Sydorenko <wk+pypa@sydorenko.org.ua>"
 LABEL "repository" "https://github.com/pypa/gh-action-pypi-publish"
@@ -7,9 +7,19 @@ LABEL "homepage" "https://github.com/pypa/gh-action-pypi-publish"
 ENV PYTHONDONTWRITEBYTECODE 1
 ENV PYTHONUNBUFFERED 1
 
+ENV PIP_NO_CACHE_DIR 1
+
+ENV PATH "/root/.local/bin:${PATH}"
+ENV PYTHONPATH "/root/.local/lib/python3.11/site-packages"
+
+COPY requirements requirements
 RUN \
-  pip install --upgrade --no-cache-dir pip-with-requires-python && \
-  pip install --upgrade --no-cache-dir --prefer-binary twine
+  PIP_CONSTRAINT=requirements/runtime-prerequisites.txt \
+    pip install --user --upgrade --no-cache-dir \
+      -r requirements/runtime-prerequisites.in && \
+  PIP_CONSTRAINT=requirements/runtime.txt \
+    pip install --user --upgrade --no-cache-dir --prefer-binary \
+      -r requirements/runtime.in
 
 WORKDIR /app
 COPY LICENSE.md .

README.md

@@ -1,5 +1,8 @@
 [![SWUbanner]][SWUdocs]
 
+[![🧪 GitHub Actions CI/CD workflow tests badge]][GHA workflow runs list]
+[![pre-commit.ci status badge]][pre-commit.ci results page]
+
 # PyPI publish GitHub Action
 
 This action allows you to upload your [Python distribution packages]
@@ -25,14 +28,13 @@ To use the action add the following step to your workflow file (e.g.
 - name: Publish a Python distribution to PyPI
   uses: pypa/gh-action-pypi-publish@release/v1
   with:
-    user: __token__
     password: ${{ secrets.PYPI_API_TOKEN }}
 ```
 
-> **Pro tip**: instead of using branch pointers, like `master`, pin versions of
-Actions that you use to tagged versions or sha1 commit identifiers. This will
-make your workflows more secure and better reproducible, saving you from sudden
-and unpleasant surprises.
+> **Pro tip**: instead of using branch pointers, like `unstable/v1`, pin
+versions of Actions that you use to tagged versions or sha1 commit identifiers.
+This will make your workflows more secure and better reproducible, saving you
+from sudden and unpleasant surprises.
 
 A common use case is to upload packages only on a tagged commit, to do so add a
 filter to the step:
@@ -50,7 +52,6 @@ So the full step would look like:
   if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
   uses: pypa/gh-action-pypi-publish@release/v1
   with:
-    user: __token__
     password: ${{ secrets.PYPI_API_TOKEN }}
 ```
 
@@ -112,7 +113,6 @@ The action invocation in this case would look like:
 - name: Publish package to TestPyPI
   uses: pypa/gh-action-pypi-publish@release/v1
   with:
-    user: __token__
     password: ${{ secrets.TEST_PYPI_API_TOKEN }}
     repository_url: https://test.pypi.org/legacy/
 ```
@@ -127,7 +127,6 @@ would now look like:
 - name: Publish package to PyPI
   uses: pypa/gh-action-pypi-publish@release/v1
   with:
-    user: __token__
     password: ${{ secrets.PYPI_API_TOKEN }}
     packages_dir: custom-dir/
 ```
@@ -181,12 +180,34 @@ It will show SHA256, MD5, BLAKE2-256 values of files to be uploaded.
     print_hash: true
 ```
 
+### Specifying a different username
+
+The default username value is `__token__`. If you publish to a custom
+registry that does not provide API tokens, like `devpi`, you may need to
+specify a custom username and password pair. This is how it's done.
+
+```yml
+  with:
+    user: guido
+    password: ${{ secrets.DEVPI_PASSWORD }}
+```
+
 ## License
 
 The Dockerfile and associated scripts and documentation in this project
 are released under the [BSD 3-clause license](LICENSE.md).
 
 
+[🧪 GitHub Actions CI/CD workflow tests badge]:
+https://github.com/pypa/gh-action-pypi-publish/actions/workflows/self-smoke-test-action.yml/badge.svg?branch=unstable%2Fv1&event=push
+[GHA workflow runs list]:
+https://github.com/pypa/gh-action-pypi-publish/actions/workflows/self-smoke-test-action.yml?query=branch%3Aunstable%2Fv1
+
+[pre-commit.ci results page]:
+https://results.pre-commit.ci/latest/github/pypa/gh-action-pypi-publish/unstable/v1
+[pre-commit.ci status badge]:
+https://results.pre-commit.ci/badge/github/pypa/gh-action-pypi-publish/unstable/v1.svg
+
 [Creating & using secrets]:
 https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets
 [has nothing to do with _building package distributions_]:
@@ -195,7 +216,7 @@ https://github.com/pypa/gh-action-pypi-publish/issues/11#issuecomment-530480449
 https://packaging.python.org/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
 [PyPI API token]: https://pypi.org/help/#apitoken
 [Python distribution packages]:
-https://packaging.python.org/glossary/#term-distribution-package
+https://packaging.python.org/glossary/#term-Distribution-Package
 [SWUbanner]:
 https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/banner-direct-single.svg
 [SWUdocs]:

action.yml

@@ -19,21 +19,21 @@ inputs:
   verify_metadata:
     description: Check metadata before uploading
     required: false
-    default: true
+    default: 'true'
   skip_existing:
     description: >-
       Do not fail if a Python package distribution
       exists in the target package index
     required: false
-    default: false
+    default: 'false'
   verbose:
     description: Show verbose output.
     required: false
-    default: false
+    default: 'false'
   print_hash:
     description: Show hash values of files to be uploaded
     required: false
-    default: false
+    default: 'false'
 branding:
   color: yellow
   icon: upload-cloud

requirements/runtime-prerequisites.in

@@ -0,0 +1 @@
+pip-with-requires-python

requirements/runtime-prerequisites.txt

@@ -0,0 +1,12 @@
+#
+# This file is autogenerated by pip-compile with Python 3.11
+# by the following command:
+#
+#    pip-compile --allow-unsafe --output-file=requirements/runtime-prerequisites.txt --resolver=backtracking --strip-extras requirements/runtime-prerequisites.in
+#
+pip-with-requires-python==1.0.1
+    # via -r requirements/runtime-prerequisites.in
+
+# The following packages are considered to be unsafe in a requirements file:
+pip==22.3.1
+    # via pip-with-requires-python

requirements/runtime.in

@@ -0,0 +1,11 @@
+twine
+
+# NOTE: `pkginfo` is a transitive dependency for us that is coming from Twine.
+# NOTE: It is declared here only to avoid installing a broken combination of
+# NOTE: the distribution packages. This should be removed once a fixed version
+# NOTE: of Twine is out.
+# Refs:
+# * https://github.com/pypa/gh-action-pypi-publish/issues/107
+# * https://github.com/pypa/twine/issues/940
+# * https://github.com/pypa/twine/pull/941
+pkginfo != 1.9.0

requirements/runtime.txt

@@ -0,0 +1,72 @@
+#
+# This file is autogenerated by pip-compile with Python 3.11
+# by the following command:
+#
+#    pip-compile --allow-unsafe --output-file=requirements/runtime.txt --resolver=backtracking --strip-extras requirements/runtime.in
+#
+bleach==5.0.1
+    # via readme-renderer
+certifi==2022.9.24
+    # via requests
+cffi==1.15.1
+    # via cryptography
+charset-normalizer==2.1.1
+    # via requests
+commonmark==0.9.1
+    # via rich
+cryptography==38.0.4
+    # via secretstorage
+docutils==0.19
+    # via readme-renderer
+idna==3.4
+    # via requests
+importlib-metadata==5.1.0
+    # via
+    #   keyring
+    #   twine
+jaraco-classes==3.2.3
+    # via keyring
+jeepney==0.8.0
+    # via
+    #   keyring
+    #   secretstorage
+keyring==23.11.0
+    # via twine
+more-itertools==9.0.0
+    # via jaraco-classes
+pkginfo==1.9.2
+    # via
+    #   -r requirements/runtime.in
+    #   twine
+pycparser==2.21
+    # via cffi
+pygments==2.13.0
+    # via
+    #   readme-renderer
+    #   rich
+readme-renderer==37.3
+    # via twine
+requests==2.28.1
+    # via
+    #   requests-toolbelt
+    #   twine
+requests-toolbelt==0.10.1
+    # via twine
+rfc3986==2.0.0
+    # via twine
+rich==12.6.0
+    # via twine
+secretstorage==3.3.3
+    # via keyring
+six==1.16.0
+    # via bleach
+twine==4.0.1
+    # via -r requirements/runtime.in
+urllib3==1.26.13
+    # via
+    #   requests
+    #   twine
+webencodings==0.5.1
+    # via bleach
+zipp==3.11.0
+    # via importlib-metadata

twine-upload.sh

@@ -1,7 +1,22 @@
-#! /usr/bin/env bash
+#! /bin/bash
+
+if [[ -n "${DEBUG}" ]]
+then
+    set -x
+fi
+
 set -Eeuo pipefail
 
 
+# NOTE: These variables are needed to combat GitHub passing broken env vars
+# NOTE: from the runner VM host runtime.
+# Ref: https://github.com/pypa/gh-action-pypi-publish/issues/112
+export PATH="/usr/bin:${PATH}"  # To find `id`
+. /etc/profile  # Makes python and other executables findable
+export PATH="$(python -m site --user-base)/bin:${PATH}"
+export PYTHONPATH="$(python -m site --user-site):${PYTHONPATH}"
+
+
 if [[
     "$INPUT_USER" == "__token__" &&
     ! "$INPUT_PASSWORD" =~ ^pypi-