[kddejong]

Description of changes:

Follow-up to #4990, which added the release-tag check and attached the source distribution to stable GitHub releases. Three adjustments to cd-pypi.yaml.

1. Publish to PyPI before uploading the release asset.

As merged, the upload step sits between Build distributions and Publish to PyPI, so any failure attaching the asset fails the job and the release never reaches PyPI. Publishing is the irreversible step, so it now runs first and a GitHub-side problem can no longer block it.

2. --clobber on gh release upload.

Without it, a workflow re-run after a partial failure fails again on the asset already attached — exactly the situation a re-run is meant to recover from. gh release upload --help documents --clobber as "Delete and re-upload existing assets of the same name".

3. Pin pypa/gh-action-pypi-publish.

release/v1 is a branch, so it moves on every PyPA release, and this job holds id-token: write for trusted publishing plus contents: write for the asset upload. Pinned to 7245906fb61fa33a13554f9d5fb856fe61758086, the commit v1.14.3 dereferences to. Dependabot already tracks github-actions weekly, so the pin will be kept current.

First-party actions/checkout and actions/setup-python are deliberately left on their major tags — the trust boundary for those is GitHub itself, which already owns the runner and the token service, so a pin defends against nothing.

Evidence and verification:

The workflow only fires on release: published in this repository, so no CI run exercises it and the first real execution is a live release. Verified what can be verified locally:

• Step order after the change is … Build distributions → Determine release stability → Publish to PyPI → Upload stable source distribution, confirmed by parsing the YAML.
• bash -n clean on all five run: blocks.
• The upload block's command assembles correctly with the new flag: gh release upload v1.59.0 dist/cfn_lint-1.59.0.tar.gz --repo aws-cloudformation/cfn-lint --clobber.
• The sdist guard still behaves at 0, 1 and 2 tarballs, and against a real dist/ holding one sdist plus one wheel.
• v1.14.3^{} resolves to 7245906fb61fa33a13554f9d5fb856fe61758086 via git ls-remote.
• pre-commit run --all-files — all hooks pass.
• pytest test/unit — 3407 passed.

What is unchanged:

The release-tag validation and stability-classification logic is untouched, including its position relative to the build. Its body was re-run against 13 tag/version combinations and behaves as merged: correct on every stable case, hard-fails on a tag mismatch or an unreadable version. A sweep of all 190 v1.* tags against src/cfnlint/version.py at each tagged commit found 165 stable tags with zero mismatches, so the guard changes nothing for a normal release.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.81%. Comparing base (0772607) to head (260a980).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4996   +/-   ##
=======================================
  Coverage   94.81%   94.81%           
=======================================
  Files         441      441           
  Lines       16179    16179           
  Branches     3137     3137           
=======================================
  Hits        15340    15340           
  Misses        463      463           
  Partials      376      376           

Flag	Coverage Δ
unittests	94.80% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.