Repository: astral-sh/uv
File: scripts/publish/test_publish.py (Python)

Code before:
                f"---\n{output}\n---"
            )

    mode = "index" if all_targets[target].index else "check URL"
    print(
        f"\n=== 3. Publishing {project_name} {version} again with {mode} ===",
        file=sys.stderr,
    )
    wait_for_index(index_url, project_name, version, uv, env)
    # Test twine-style and index-style uploads for different packages.
    if index := all_targets[target].index:
        args = [
            uv,
            "publish",
            "--index",
            index,
            *extra_args,
        ]
    else:
        args = [
            uv,
            "publish",
            "--publish-url",
            publish_url,
            "--check-url",
            index_url,
            *extra_args,
        ]
    output = run(
        args, cwd=project_dir, env=env, text=True, check=True, stderr=PIPE
    ).stderr

    if output.count("Uploading") != 0 or output.count("already exists") != len(
        expected_filenames
    ):
        raise RuntimeError(
            f"Re-upload with check URL failed: "
            f"{output.count('Uploading')} != 0, "
            f"{output.count('already exists')} != {len(expected_filenames)}\n"
            f"---\n{output}\n---"
        )

    # Build a different source dist and wheel at the same version, so the upload fails
    del project_dir
    modified_project_dir = build_project_at_version(target, version, uv, modified=True)

    print(
        f"\n=== 4. Publishing modified {project_name} {version} "
        f"again with skip existing (error test) ===",
        file=sys.stderr,
    )

Review comment (bug):
Flagging: the nuance here is that GitLab, unlike GitHub and other TP providers, doesn't have an "active" OIDC source: the runner gets a single OIDC credential at startup. As a result of that PyPI (and pyx) consider the OIDC credential "spent" after its first use, meaning that our duplicate/conflict/etc. tests all fail for an unrelated reason (the index is rejecting our credential as reused).

There's no great way around this, it's seemingly an architectural limitation of GitLab. But the good news is that it won't affect typical user workflows, it only dings us here because we're intentionally re-using an OIDC credential across separate `uv publish` invocations 🙂 

Code after:
            result.check_returncode()

    if plan.configuration.attestations:
        wait_for_index(plan, version)
        check_index_for_provenance(plan, version, client)

    return version, project_dir, expected_filenames


def test_reupload_same_files(
    plan: Plan,
    version: Version,
    project_dir: Path,
    expected_filenames: list[str],
):
    """Test that re-uploading the same files works on PyPI.

    NOTE: This skips Trusted Publishing with GitLab, since it uses
    a static OIDC token that can't be reused across `uv publish` invocations.
    """

    if plan.configuration.publish_url != TEST_PYPI_PUBLISH_URL:
        return

    if plan.target in ("pypi-trusted-publishing-gitlab",):
        return

    # Confirm pypi behaviour: Uploading the same file again is fine.
    # This doesn't work for Trusted Publishing with GitLab, since
    # there's a single static OIDC token that can't be reused.
    print(
        f"\n=== 2. Publishing {plan.configuration.project_name} {version} again (PyPI) ===",
        file=sys.stderr,
    )
    wait_for_index(plan, version)
    args = [
        plan.uv,
        "publish",
        "--publish-url",
        plan.configuration.publish_url,
        *plan.extra_args,
    ]
    output = run(
        args,
        cwd=project_dir,
        env=plan.full_env(),
        text=True,
        check=True,
        stderr=PIPE,
    ).stderr
    if (