chore: use api tokens for pypi deploys (#14464)

* chore: use api tokens for pypi deploys

* enforce latest pip

* perhaps latest pipenv

.github/actions/python/pypi-deploy/action.yaml

@@ -28,7 +28,7 @@ runs:
           fi
         fi
         status=0
-        CI=1 QUIET=1 BUILD_NUMBER=${OT_BUILD} make -C ${{ inputs.project }} clean deploy twine_repository_url=${{ inputs.repository_url }} pypi_username=opentrons pypi_password=${{ inputs.password }} || status=$?
+        CI=1 QUIET=1 BUILD_NUMBER=${OT_BUILD} make -C ${{ inputs.project }} clean deploy twine_repository_url=${{ inputs.repository_url }} pypi_username=__token__ pypi_password=${{ inputs.password }} || status=$?
         if [[ ${status} != 0 ]] && [[ ${{ inputs.repository_url }} =~ "test.pypi.org" ]]; then
           echo "upload failures allowed to test pypi"
           exit 0

.github/actions/python/setup/action.yaml

@@ -27,6 +27,7 @@ runs:
     - shell: bash
       run: |
         npm install --global [email protected]
-        $OT_PYTHON -m pip install pipenv==2023.11.15
+        $OT_PYTHON -m pip install --upgrade pip
+        $OT_PYTHON -m pip install pipenv==2023.12.1
     - shell: bash
       run: 'make -C ${{ inputs.project }} setup'

.github/workflows/api-test-lint-deploy.yaml

@@ -165,11 +165,11 @@ jobs:
         with:
           project: 'api'
           repository_url: 'https://test.pypi.org/legacy/'
-          password: '${{ secrets.OT_TEST_PYPI_PASSWORD }}'
+          password: '${{ secrets.TEST_PYPI_DEPLOY_TOKEN_OPENTRONS }}'
       - if: startsWith(env.OT_TAG, 'v')
         name: 'upload to real pypi'
         uses: './.github/actions/python/pypi-deploy'
         with:
           project: 'api'
           repository_url: 'https://upload.pypi.org/legacy/'
-          password: '${{ secrets.OT_PYPI_PASSWORD }}'
+          password: '${{ secrets.PYPI_DEPLOY_TOKEN_OPENTRONS }}'

.github/workflows/shared-data-test-lint-deploy.yaml

@@ -179,14 +179,14 @@ jobs:
         with:
           project: 'shared-data/python'
           repository_url: 'https://test.pypi.org/legacy/'
-          password: '${{ secrets.OT_TEST_PYPI_PASSWORD }}'
+          password: '${{ secrets.TEST_PYPI_DEPLOY_TOKEN_OPENTRONS_SHARED_DATA }}'
       - if: startsWith(env.OT_TAG, 'v')
         name: 'upload to pypi'
         uses: './.github/actions/python/pypi-deploy'
         with:
           project: 'shared-data/python'
           repository_url: 'https://upload.pypi.org/legacy/'
-          password: '${{ secrets.OT_PYPI_PASSWORD }}'
+          password: '${{ secrets.PYPI_DEPLOY_TOKEN_OPENTRONS_SHARED_DATA }}'
 
   publish-switch:
     runs-on: 'ubuntu-latest'

Makefile

@@ -65,7 +65,8 @@ PYTHON_SETUP_TARGETS := $(addsuffix -py-setup, $(PYTHON_DIRS))
 
 .PHONY: setup-py
 setup-py:
-	$(OT_PYTHON) -m pip install pipenv==2023.11.15
+	$(OT_PYTHON) -m pip install --upgrade pip
+	$(OT_PYTHON) -m pip install pipenv==2023.12.1
 	$(MAKE) $(PYTHON_SETUP_TARGETS)