Use an API token for uploading to PyPI from Travis CI instead of account creds

[webknjaz]

Issue Type

• Infra improvement

Desired Behaviour

It is now possible to create an API token at https://pypi.org/manage/account/token/. Travis CI autoreleases should switch to that.

Ref: https://discuss.python.org/t/pypi-security-work-multifactor-auth-progress-help-needed/1042/31

Use __token__ for a username and the token itself for a password when using Twine: pypi/warehouse#994 (comment)

[ssbarnea]

On other project I use a service account and added below variables directly to Travis admin interface (no need to edit travis file):

TWINE_USERNAME=...
TWINE_PASSWORD=...
PYPI_USER=...
PYPI_PASSWORD=...
PYPI_DISTRIBUTIONS="sdist bdist_wheel"

They will be secured by travis. In fact once you introduce it, you cannot see it again.

PS. Yes, you can use tokens there as password.

[webknjaz]

I know. Yet, there's certain problems with tokens&travis now + it's in beta anyway. I'm going to wait.
FWIW I like having explicit thing in .travis.yaml better than semi-hidden UI configs.

[ssbarnea]

TBH I do not care much which method is used as long the release happens. I am currently blocked by the unreleased fix from 69f5e96 and I know several people that started to contemplate ditching ansible-lint due to its problems. I would be happy not to give them more reasons ;)

[webknjaz]

Creds aren't a blocker at all.

[ssbarnea]

Considering that this ticket can be addressed only by a very select group of people it would be nice if they could make that change. AFAIK tokens are working fine, I am already using them on other projects.

[webknjaz]

@ssbarnea actually, Travis CI still has encryption problems in some repos. But we won't know until we try.

[webknjaz]

Addressed by #840 + #857 + #873.