Leaked admin access token to Python, PyPI, and PSF GitHub repos

Yikes, TIL: never build production artifacts from a development checkout?

There is a reason CI/CD servers exist.

Heck there's a few pieces of software I work on that I can't build locally, I just push WIPs to CI/CD.

I could try to setup a CI/CD pipeline of my own, but it isn't worth the time.

This, in part, is why distributions like Debian go to the trouble they do to build everything from more-or-less isolated sourcecode artifacts.

Sure, its not always perfect, and getting say, blobless, is a challenge of its own, but no distro in their right mind for example, would ship arbitrary .o or ld.so objects in source packages.

Maybe I'm too young, but I can't imagine building stuff locally and then pushing. Too messy later figuring out why stuff worked on your machine but not the end users'. I like way better setting up a CI pipeline on GitHub, building stuff remotely and then downloading the final binary to my own device or a VM to do manual testing.