From 260a9807130f69ffe54786e4e8e72c8afa1c9e70 Mon Sep 17 00:00:00 2001 From: Kevin DeJong Date: Thu, 5 Nov 2026 20:08:32 +0000 Subject: [PATCH] ci: publish to pypi before uploading the release asset The sdist upload ran between the build and the publish step, so a GitHub API failure stopped the release from reaching PyPI. Publishing is the irreversible step, so it now runs first and a problem attaching the asset can no longer block it. Add --clobber to gh release upload so a re-run after a partial failure is idempotent instead of failing on the asset already present. Pin pypa/gh-action-pypi-publish to the v1.14.3 commit. release/v1 is a branch that moves on every PyPA release, and this job holds id-token: write for trusted publishing. Follow-up to #4990. --- .github/workflows/cd-pypi.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cd-pypi.yaml b/.github/workflows/cd-pypi.yaml index 2c0b21d79..b6ce80c64 100644 --- a/.github/workflows/cd-pypi.yaml +++ b/.github/workflows/cd-pypi.yaml @@ -57,6 +57,8 @@ jobs: else echo "stable=false" >> "$GITHUB_OUTPUT" fi + - name: Publish to PyPI + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 - name: Upload stable source distribution to GitHub release if: >- github.event.release.prerelease == false && @@ -73,6 +75,4 @@ jobs: fi gh release upload "$RELEASE_TAG" "${sdists[0]}" \ - --repo "$GITHUB_REPOSITORY" - - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + --repo "$GITHUB_REPOSITORY" --clobber