Skip to content

Commit 00857ed

Browse files
tiranclaude
andcommitted
ci: use PyPI attestations instead of sigstore + gh release upload
Replace sigstore signing and gh release upload with PyPI publish attestations. Fixes release upload failure for v0.3.0. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heimes <cheimes@redhat.com>
1 parent 9930548 commit 00857ed

1 file changed

Lines changed: 12 additions & 28 deletions

File tree

.github/workflows/pypi.yaml

Lines changed: 12 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -35,45 +35,29 @@ jobs:
3535

3636
- uses: hynek/build-and-inspect-python-package@fe0a0fb1925ca263d076ca4f2c13e93a6e92a33e # v2.17.0
3737

38-
# push to Production PyPI on
39-
# - a new GitHub release is published
4038
publish-pypi:
41-
name: Publish release to pypi.org
39+
name: Publish to PyPI
40+
if: github.repository_owner == 'python-wheel-build' && github.event.action == 'published'
41+
needs: build-package
42+
runs-on: ubuntu-latest
4243
environment: pypi
43-
if: |
44-
github.repository_owner == 'python-wheel-build' && github.event.action == 'published'
4544
permissions:
46-
# see https://docs.pypi.org/trusted-publishers/
4745
id-token: write
48-
# allow gh release upload
49-
contents: write
50-
51-
runs-on: ubuntu-latest
52-
needs: build-package
53-
46+
attestations: write
47+
contents: read
5448
steps:
5549
- name: Fetch build artifacts
5650
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
5751
with:
5852
name: Packages
5953
path: dist
6054

61-
- uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
62-
with:
63-
inputs: >-
64-
./dist/*.tar.gz
65-
./dist/*.whl
66-
67-
- name: Upload artifacts and signatures to GitHub release
68-
env:
69-
GITHUB_TOKEN: ${{ github.token }}
70-
run: >-
71-
gh release upload '${{ github.ref_name }}' dist/* --repo '${{ github.repository }}'
72-
73-
# PyPI does not accept .sigstore artifacts and
74-
# gh-action-pypi-publish has no option to ignore them.
75-
- name: Remove sigstore signatures before uploading to PyPI
76-
run: rm ./dist/*.sigstore
55+
- name: Verify sdist and wheel are present
56+
run: |
57+
ls dist/*.tar.gz
58+
ls dist/*.whl
7759
7860
- name: Upload to PyPI
7961
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
62+
with:
63+
attestations: true

0 commit comments

Comments
 (0)