Can't upload pypi packages to public repositories - 403 Forbidden

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Close this issue

Summary

Uploading to the repository's Pypi registry fails with 403 Forbidden on public repositories.

Steps to reproduce

1. Fork jorgecarleitao/test-pypi

2. Add a new deploy token with scopes to read and write from/to registry:

   

3. Add two variables in CI/CD with those credentials:

   

4. Trigger a build on master.

   This will run

   - pip install twine
   - python setup.py sdist
   - python -m twine upload --repository-url https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/packages/pypi dist/*

5. See the upload to fail (e.g. https://gitlab.com/jorgecarleitao/test-pypi/-/jobs/673337176)

I also reproduced this in my local computer by running the steps above after exporting the two variables.

What is the current bug behavior?

The package upload fails with a 403 Forbidden

What is the expected correct behavior?

The package should be correctly uploaded to the package registry.

Output of checks

This bug happens on GitLab.com