Hackage account org secret

[jamesdbrock]

The first order of business is to figure out how to create a Hackage account and store the secret password in this org.

[fumieval]

This is a really promising project! How about using https://github.com/organizations/haskell-github-trust/settings/secrets/actions ?

[jamesdbrock]

Thanks for joining! Yeah we want set up Github Encrypted Secrets, or something like it.

[jamesdbrock]

Ok I've created a secret in https://github.com/organizations/haskell-github-trust/settings/secrets/actions

Now how do I create a CI action for publishing to Hackage....?

https://markkarpov.com/post/github-actions-for-haskell-ci.html

https://github.com/actions/cache/blob/main/examples.md#haskell---cabal

https://vrom911.github.io/blog/github-actions-releases

https://kodimensional.dev/github-actions

https://github.com/haskell-actions/hackage-publish

https://hackage.haskell.org/package/hkgr

[jamesdbrock]

Publish to Hackage on the release event? https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release

[jamesdbrock]

Can we constraint the GitHub release number to be the same as the version number in the .cabal file?

[fumieval]

https://github.com/haskell-actions/hackage-publish looks promising

[jamesdbrock]

Probably, for publishing to Hackage, it would be best to manually trigger the publishing action https://docs.github.com/en/actions/managing-workflow-runs/manually-running-a-workflow

[jamesdbrock]

https://github.com/haskell/actions

[jamesdbrock]

Notes from conversation with @vaibhavsagar :

hackage trustees strongly prefer not to grant uploader privileges to organization accounts like that one, rather they prefer to grant privileges to people

e.g. for https://hackage.haskell.org/package/nri-prelude , the NoRedInk user is a maintainer and does not have upload permissions

so then the organization account acts as a holding account that grants and revokes maintainer (status) to other (uploader) accounts as required

If the Hackage haskell_github_trust account cannot be an uploader account, then it’s impossible to configure this org so that every org Owner is able to publish any package in the org without knowing the Hackage haskell_github_trust password.

Further discussion here haskell-infra/hackage-trustees#362

[jamesdbrock]

Synopsis of haskell-infra/hackage-trustees#362 :

We're not going to do a Hackage Authentication Token GitHub Secret, because the Hackage policies discourage that.

Instead the haskell_github_trust account will be a “Group Account” as described in https://hackage.haskell.org/upload

Group Accounts

Occasionally organizations want to have a group / organizational account for a package that is maintained by a group of people. The recommended approach for these cases is to only do package uploads from individual accounts and use the group account only for managing the maintainer list for the package.