Use environment variables instead of contexts

[tomkins]

Closes #1748

Updates the "Signing the distribution packages" section to use environment variables rather than GitHub Actions context variables. No additional setting of environment variables are needed - these are all set/available already.

I've got a repo where we're using trusted publishing, although it's a slight variation on this, but hopefully it's an example that the environment variables work just fine:

https://github.com/developersociety/django-findreplace/blob/7fcf87397590b984dacaca58719f2d8b737d4f77/.github/workflows/publish.yml#L81
https://github.com/developersociety/django-findreplace/actions/runs/12457101550

---

📚 Documentation preview 📚: https://python-packaging-user-guide--1765.org.readthedocs.build/en/1765/

[tomkins]

I've also added a persist-credentials: false for checkout, which is another potential zizmor found issue.

This might be overkill for fixing, as in theory the directory should never be added into a package. However, if for some bizarre reason a mistake is made - it would be good to help prevent it.

After this, zizmor is happy with the file:

$ zizmor --gh-token "$(gh auth token)" ./source/guides/github-actions-ci-cd-sample/publish-to-test-pypi.yml
2024-12-22T20:51:21.772745Z  INFO audit: zizmor: 🌈 completed /Users/tomkins/Development/packaging.python.org/source/guides/github-actions-ci-cd-sample/publish-to-test-pypi.yml
No findings to report. Good job! (9 suppressed)

[ncoghlan]

LGTM! Thanks.

I added a link to the relevant zizmor issue explanation to the original bug report.

[ncoghlan]

PyPI still has its webscraping protections turned on (#1744), so I expect the merge request to fail (alas)

[ncoghlan]

Pending checks seem to be in a weird state. Closing/reopening to try to kick them.

[ncoghlan]

Huh, looks like it may have been a bug in the new check review widget (the workflows needed approval to run, but the review widget didn't tell me that, I had to go look at the Actions UI).

Edit: checking the feedback request post at https://github.com/orgs/community/discussions/143787, that's a known limitation of the new widget (and fixing it is already on their TODO list)

[webknjaz]

@ncoghlan I've working around that by manually going to the checks/actions tab and clicking the button in the workflow..