title: Store credentials for twine upload of artifacts
body: <p>I'm building my python package using Azure DevOps pipeline and the generated artifact is then uploaded to a feed. Everything is working fine, however, I don't like the fact that I have a <code>.pypirc</code> file containing the credentials for the upload sitting in my repository.</p>
  
  <p>Basically I'm uploading the artifact using:</p>
  
  <pre><code>- script: 'twine upload -r imglib --config-file .pypirc dist/imglib-*.tar.gz'
  </code></pre>
  
  <p>Is there another way to store the credentials, preferably not in a file that anyone could edit? I read something about storing the credentials in the key vault, but I don't see how change the pipeline (the yml file) to do this.</p>
  
  <p>Thanks in advance.</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>Shaykis answere seems to be the right way, however, I'm not able to replace the placeholder in the .pypirc file using a bash command. All I get is three asterics when I print the content of .pypirc after replacement. For the replacement I use: </p>
  
  <pre><code>- script: 'sed -i "s/__password__/$PYPI_CRED_MAPPED/g" .pypirc'
    displayName: 'Setting PyPI credentials'
    env:
      PYPI_CRED_MAPPED: $(pypi_cred)
  </code></pre>
  
  <p>The content of .pypirs is (displayed during the build task using a bash <code>cat .pypirc</code>. Is there an easier way to debug the build prozess?):</p>
  
  <pre><code>[distutils]
  Index-servers =
    pypi
    imglib
  
  [imglib]
  Repository = https://pkgs.dev.azure.com/XXX/_packaging/imglib/pypi/upload
  username = imglib
  password = ***
  </code></pre>
  
  <p>Does anyone know what is happening there?</p>
  
  <p><strong>EDIT 2:</strong></p>
  
  <p>I also tried to use <code>$env:PYPI_CRED_MAPPED</code> but in that case only the $env is replaced by nothing and all I'm left with is <code>:PYPI_CRED_MAPPED</code>. Also, I look at the <a href="https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/utility/bash?view=azure-devops" rel="nofollow noreferrer">docs</a> and they use the variable directly (e.g. <code>$PYPI_CRED_MAPPED</code>, see bottom of page).</p>
  
  <p><strong>EDIT 3:</strong></p>
  
  <p>The three asterics are just a placeholder. It worked with <code>$PYPI_CRED_MAPPED</code> as mentioned in <strong>EDIT 2</strong>. The build process was failing because of another reason. I also tried it with the powershell command provided in the answer and it worked as well. So thank you for your help.</p>