ci: exclude attestation sidecars from the PyPI artifact-identity assert - #124
Merged
Conversation
gh-action-pypi-publish v1.14+ writes <dist>.publish.attestation sidecar files into packages-dir before uploading. The post-publish assert builds its expected set from dist/ contents, and PyPI serves attestations via the integrity API rather than as distribution files, so the sidecars can never appear in the JSON API's urls[] -- the assert now fails on every release even when the publish is complete and attested. Observed on the v0.10.1 run (32177134404): both distributions matched by sha256 and both files have provenance bundles on the integrity API, but the two sidecar names failed the set comparison twice (initial run and skip-existing re-run). Filter *.publish.attestation from the local set; the distribution set-equality check (including the planted-extra-wheel direction) is unchanged. 🤖 Generated with Claude Code Co-Authored-By: [Claude](mailto:noreply@anthropic.com)
tmatup
requested review from
akshaylive,
bai-uipath and
uipreliga
as code owners
August 18, 2026 19:39
|
Claude finished @tmatup's task in 1m 26s —— View job Code Review in Progress
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Release run 32177134404 (v0.10.1, dispatched after #123) published successfully — both distributions are served by PyPI with matching sha256, and both have provenance bundles on the integrity API (
/integrity/coder-eval/0.10.1/<file>/provenance→ HTTP 200, 1 bundle each). Yet Assert PyPI serves this run's artifacts failed twice (initial run and theskip-existingre-run):Cause:
gh-action-pypi-publishv1.14+ (pinned by #123) writes<dist>.publish.attestationsidecars intopackages-dirbefore upload. The assert builds its expected set fromdist/contents, and PyPI never serves attestations as distribution files (they live behind the integrity API) — so the sidecars fail the set comparison on every future release, even a perfect one.Fix
Filter
*.publish.attestationout of the local set. The distribution set-equality check — including its planted-extra-wheel direction — is unchanged. (A follow-up could additionally assert provenance presence via the integrity API; deliberately not bundled here to keep the recovery unblocking minimal.)State
v0.10.1 is complete and attested on PyPI (project latest) but its
promotejob (GitHub Release + major-tag move) was skipped by the failing assert. Re-runs reuse the original workflow snapshot, so this fix cannot rescue run 32177134404 itself — recovery options are in the PR discussion.🤖 Generated with Claude Code
https://claude.ai/code/session_01AVJhcHfkcKZEdj2ivLXcbJ