Skip to content

Repair PyPI release artifact verification #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Coding-Dev-Tools merged 1 commit into from
Jul 23, 2026
Merged

Repair PyPI release artifact verification #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,15 @@ jobs:
python scripts/verify_release_artifacts.py --dist dist
--version "${GITHUB_REF_NAME#v}" --allow-subset

# The trusted publisher may write a receipt beside the distributions. Preserve
# the exact set that passed validation so the post-publish check cannot be
# affected by that implementation detail.
- name: Freeze verified distribution set
shell: bash
run: |
mkdir verified-dist
cp dist/*.whl dist/*.tar.gz verified-dist/

- name: Publish distributions to PyPI
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
with:
Expand All @@ -205,7 +214,7 @@ jobs:
- name: Require the exact complete PyPI file set
shell: bash
run: >-
python scripts/verify_release_artifacts.py --dist dist
python scripts/verify_release_artifacts.py --dist verified-dist
--version "${GITHUB_REF_NAME#v}" --retries 18 --delay 10

github-release:
Expand Down Expand Up @@ -319,6 +328,14 @@ jobs:
python scripts/verify_release_artifacts.py --dist dist
--version "${RELEASE_TAG#v}" --allow-subset

# gh-action-pypi-publish can leave its receipt in dist. Keep the approved
# artifact set separate for the exact immutable-PyPI verification below.
- name: Freeze verified distribution set
shell: bash
run: |
mkdir verified-dist
cp dist/*.whl dist/*.tar.gz verified-dist/

- name: Publish only missing verified distributions
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
with:
Expand All @@ -329,7 +346,7 @@ jobs:
RELEASE_TAG: ${{ inputs.release_tag }}
shell: bash
run: >-
python scripts/verify_release_artifacts.py --dist dist
python scripts/verify_release_artifacts.py --dist verified-dist
--version "${RELEASE_TAG#v}" --retries 18 --delay 10

- name: Repair GitHub Release
Expand Down
2 changes: 2 additions & 0 deletions tests/test_release_infrastructure.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,6 +122,8 @@ def test_release_repair_requires_tag_sha_successful_build_publish_and_pypi_ident
assert repair.count("scripts/verify_release_artifacts.py") == 2
assert "--allow-subset" in repair
assert "--retries 18 --delay 10" in repair
assert repair.count("Freeze verified distribution set") == 1
assert "--dist verified-dist" in repair
assert "skip-existing: true" in repair
assert "id-token: write" in repair

Expand Down