What the developer wrote
Authored by Mathias BROUSSET
remove pypi token
What changed, and why it matters
This commit removes a PyPI (Python package publishing) API token from a public GitHub Actions workflow file. The change itself is a cleanup step, likely after the token was exposed or no longer needed. It does not show whether the token was ever valid, leaked, or misused, but removing exposed credentials is a standard security hygiene measure.
Treat the removed token as potentially compromised: revoke/rotate the PyPI API token, audit PyPI release history for unauthorized package versions, review repository access logs and GitHub Actions run history for misuse, and verify no other branches or forks still contain the secret.
Security signals we found
Removal of a long-lived PyPI API token from CI configuration
Potential prior exposure of a package-publishing secret in repository source control
Reduction of supply-chain attack surface if the token was active
Evidence from the diff
The diff deletes a secrets: block that passed secrets.PYPI_PUBLIC_API_TOKEN to a reusable workflow named python-app in .github/workflows/ci-workflow.yml. The commit message simply says ‘remove pypi token’. No further context is provided in the commit or verified references about why the token was removed, whether it was rotated, or whether it had been exposed.
Changed components
.github/workflows/ci-workflow.ymlPyPI publishing step in CI/CD pipelineInspect captured patch +0 / −2
diff --git a/.github/workflows/ci-workflow.yml b/.github/workflows/ci-workflow.yml
index ce6bf4c..b26ae87 100644
--- a/.github/workflows/ci-workflow.yml
+++ b/.github/workflows/ci-workflow.yml
@@ -183,8 +183,6 @@ jobs:
jfrog_deployment: true
release: false
publish: true
- secrets:
- pypi_token: ${{ secrets.PYPI_PUBLIC_API_TOKEN }}
job_test_js_lib:
name: Tests with the JS library
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.