Make it easier to retry in upload-pypi script

[JukkaL]

Recently the misc/upload-pypi.py script failed several times while I was uploading a release. It succeeded in uploading some wheels, but it failed at some point. It's possible to run it multiple times to work around the issue, but this is not ideal since it repeats all the work. Here some ideas about how to make this better:

• If upload fails, ask if the user wants to try uploading again. This would help by not having to download the wheels again.
• If upload fails, ask if the user wants to try uploading again, but only upload the wheels which haven't been successfully uploaded so far.
• Automatically retry, without asking for the pypi token/secret again.

Any of these would be an improvement over the current situation, but the first option might not help much if the script will just repeatedly fail at some point.

[webknjaz]

On a related note, have you considered getting MyPy green on https://trailofbits.github.io/are-we-pep740-yet/ ?

This would require publishing from GHA: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/.

(of course, the in-repo script is still good to retain as a backup method)

P.S. There's a (kinda) related discussion @ pypa/twine#1246 in the context of a PyPI token expiring while Twine is in the process of uploading large amounts of big wheels when PyPI/network is flaky. Not exactly your case because that one is GHA-specific (GHA+Trusted Publishing), but feel free to contribute some thoughts if any.

---

If upload fails, ask if the user wants to try uploading again, but only upload the wheels which haven't been successfully uploaded so far.

For this specific point, you can stick a --skip-existing into the twine upload command, and it'll have it do the thing: https://github.com/python/mypy/blob/409d294/misc/upload-pypi.py#L111. Beyond that, you don't really have much control since all the wheels are being passed to Twine and its internals are doing the looping.

[sterliakov]

I'm a huge +1 on publishing from GHA. That isn't difficult (I have a couple workflows doing that), but ultimately depends on maintainers' stance: if they don't trust GitHub to store a PyPI toke granting access to such a popular project, it simply won't happen. And I can understand such lack of trust because Microsoft.

[emmatyping]

I agree publishing via GitHub Actions is a good idea both for robustness and attestation purposes. It also was brought up as a step towards reducing the amount of work needed to onboard new RMs if I recall correctly.