o-nikolas opened a new pull request, #72170: URL: https://github.com/apache/airflow/pull/72170
The upload steps describe the *policy* around the PyPI token — short-lived, single-use, deleted immediately afterwards, with a caveat about account-wide scope — but not how to actually create one. A release manager reaching that step has to guess at the PyPI UI and at how to get the token into twine. This turns the block into concrete steps: where the token page is, naming it after the wave so it can be found again for deletion, which scope to choose (keeping the existing caveat), that the value is shown exactly once, and how to remove it afterwards. It also reverses the order of the two ways to give twine the token. `~/.pypirc` was mentioned first, but it is the riskier option: it writes the credential to disk and silently interacts with any `[pypi]` section a release manager already has configured for their own projects. `TWINE_USERNAME`/`TWINE_PASSWORD` take precedence over `.pypirc`, keep nothing on disk, and with `read -rs` keep the token out of shell history — so that is now the documented path. The identical block in the final-upload section now points at these steps instead of repeating them, so the two cannot drift. Written up after running the 2026-08-25 provider wave. **Tested:** docs-only change; `prek run --from-ref upstream/main --stage pre-commit` is clean. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Kiro CLI (claude-fable-5) Generated-by: Kiro CLI (claude-fable-5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
