Enhanced error reporting: Trusted Publishing failures

[ModeSevenIndustrialSolutions]

Hi,

Any chance we could get the environment parameter printed prior to failures like the one below? Could save a lot of potential time troubleshooting if this isn't being passed down an action hierarchy? Actions need it as an input parameter, but I think it also needs to be set at the job level if composite actions are called, otherwise failures can occur. If this was added, all the information would be present in the failure output below when errors occur; enough to figure out that the correct environment isn't available to the called workflow (your publishing action).

Thanks in advance, Please keep up the good work you are doing...

• Matt

--

Trusted publishing exchange failure: 
Token request failed: the server refused the request for the following reasons:

* `invalid-publisher`: valid token, but no corresponding publisher (All lookup strategies exhausted)

This generally indicates a trusted publisher configuration error, but could
also indicate an internal error on GitHub or PyPI's part.


The claims rendered below are **for debugging purposes only**. You should **not**
use them to configure a trusted publisher unless they already match your expectations.

If a claim is not present in the claim set, then it is rendered as `MISSING`.

* `sub`: `repo:os-climate/osc-transformer-presteps:ref:refs/tags/v0.1.8`
* `repository`: `os-climate/osc-transformer-presteps`
* `repository_owner`: `os-climate`
* `repository_owner_id`: `85121681`
* `job_workflow_ref`: `os-climate/osc-transformer-presteps/.github/workflows/release.yaml@refs/tags/v0.1.8`
* `ref`: `refs/tags/v0.1.8`

[webknjaz]

The corresponding error message template is here: https://github.com/pypa/gh-action-pypi-publish/blob/e1dad8a/oidc-exchange.py#L76-L91. Here's what renders it: https://github.com/pypa/gh-action-pypi-publish/blob/e1dad8a/oidc-exchange.py#L164-L182, which is called @ https://github.com/pypa/gh-action-pypi-publish/blob/e1dad8a/oidc-exchange.py#L258.

cc @woodruffw — do you remember why we don't include the environment name in the debug output?

[woodruffw]

The corresponding error message template is here: e1dad8a/oidc-exchange.py#L76-L91. Here's what renders it: e1dad8a/oidc-exchange.py#L164-L182, which is called @ e1dad8a/oidc-exchange.py#L258.

cc @woodruffw — do you remember why we don't include the environment name in the debug output?

Nope, I think that was purely an oversight. Adding it to the debug output makes a lot of sense to me!