Repository: astral-sh/uv
File: crates/uv/src/commands/publish.rs (Rust)

Code before:
    if let Some(url_password) = publish_url.password() {
        if password.is_some_and(|password| password != url_password) {
            bail!("The password can't be set both in the publish URL and in the CLI");
        }
        password = Some(url_password.to_string());
        publish_url
            .set_password(None)
            .expect("Failed to clear publish URL password");
    }

    if !publish_url.username().is_empty() {
        if username.is_some_and(|username| username != publish_url.username()) {
            bail!("The username can't be set both in the publish URL and in the CLI");
        }
        username = Some(publish_url.username().to_string());
        publish_url
            .set_username("")
            .expect("Failed to clear publish URL username");
    }

    // If the user is publishing to pyx, load the credentials from the store.
    if username.is_none() && password.is_none() {
        if token_store.is_known_url(&publish_url) {
            if let Some(token) = token_store
                .access_token(
                    base_client.for_host(token_store.api()).raw_client(),
                    DEFAULT_TOLERANCE_SECS,
                )
                .await?
            {
                debug!("Using authentication token from the store");
                return Ok((publish_url, Credentials::from(token)));
            }
        }
    }

    // If applicable, attempt obtaining a token for trusted publishing.
    let trusted_publishing_token = check_trusted_publishing(
        username.as_deref(),
        password.as_deref(),
        keyring_provider,
        token_store,
        trusted_publishing,
        &publish_url,
        oidc_client,
    )
    .await?;

    let (username, mut password) =
        if let TrustedPublishResult::Configured(password) = &trusted_publishing_token {
            (Some("__token__".to_string()), Some(password.to_string()))

Review comment (bug):
This is an always-authenticate client, which means that when we attempt to retrieve the token here we deadlock because we're holding a lock on the token store here and the middleware attempts to take the lock to authenticate its request.

Instead of dealing with that complexity... which I might need to fix separately... we just skip prefetching credentials for pyx (and the subsequent prompt / warnings) and let them be retrieved as normal.

Code after:
            bail!("The password can't be set both in the publish URL and in the CLI");
        }
        password = Some(url_password.to_string());
        publish_url
            .set_password(None)
            .expect("Failed to clear publish URL password");
    }

    if !publish_url.username().is_empty() {
        if username.is_some_and(|username| username != publish_url.username()) {
            bail!("The username can't be set both in the publish URL and in the CLI");
        }
        username = Some(publish_url.username().to_string());
        publish_url
            .set_username("")
            .expect("Failed to clear publish URL username");
    }

    // If applicable, attempt obtaining a token for trusted publishing.
    let trusted_publishing_token = check_trusted_publishing(
        username.as_deref(),
        password.as_deref(),
        keyring_provider,
        token_store,
        trusted_publishing,
        &publish_url,
        oidc_client,
    )
    .await?;

    let (username, mut password) =
        if let TrustedPublishResult::Configured(password) = &trusted_publishing_token {
            (Some("__token__".to_string()), Some(password.to_string()))
        } else {
            if username.is_none() && password.is_none() {
                // Skip prompting for pyx URLs; the auth middleware will handle authentication.
                if token_store.is_known_url(&publish_url) {
                    (None, None)
                } else {
                    match prompt {
                        Prompt::Enabled => prompt_username_and_password()?,
                        Prompt::Disabled => (None, None),
                    }
                }
            } else {
                (username, password)
            }
        };

    if password.is_some() && username.is_none() {
        bail!(