warehouse icon indicating copy to clipboard operation
warehouse copied to clipboard

Support pre-filling Trusted Publisher form via URL params

Open facutuesca opened this issue 1 year ago • 0 comments

What is this?

This PR adds support for pre-filling the Trusted Publisher form via URL parameters. That is, opening the following URL (while logged in):

https://pypi.org/manage/project/my_project/settings/publishing/?provider=github&owner=my_user&repository=my_project&workflow_filename=my_workflow.yml

will open the page to create a new Trusted Publisher for my_project with the fields pre-filled:

image

This fixes https://github.com/pypi/warehouse/issues/13661 (see the last comment)

Design & implementation considerations

  • This is only implemented for the Project view, since the usecase is generating magic links to create a Trusted Publisher for an existing project. The concrete usecase is for the GH action gh-action-pypi-publish to generate a link and show it to the user whenever it's used to publish using an API token, encouraging the user to create a Trusted Publisher for that (existing) project by clicking on the magic link.
  • The only required parameter to enable pre-filling is provider. Any provider can be specified (github, gitlab, google and activestate) and they are case-insensitive.
  • The name of the parameters (owner, email, etc) are the same as the name of the form fields. This allows us to keep the implementation simple by using the URL parameters to fill the form directly without an intermediary mapping between URL param names and form field names.
  • The URL parameters do not need to have all of the form's fields. Missing fields will just be left empty.
  • URL parameters that do not match any form fields will be ignored.
  • If an unknown provider is specified, nothing is done (all fields will be empty, like the default view).
  • The tab for the pre-filled provider will be selected on page load.
  • A warning will be shown when using this feature, asking the user to double-check the values since they have been pre-filled (see the screenshot above).

cc @woodruffw @webknjaz @di

facutuesca avatar Aug 05 '24 18:08 facutuesca