From 0181110a4a33d6254d611bdfb9beb5663aad6eaf Mon Sep 17 00:00:00 2001 From: tmatup <51425734+tmatup@users.noreply.github.com> Date: Tue, 18 Aug 2026 19:39:48 +0000 Subject: [PATCH] ci: exclude attestation sidecars from the PyPI artifact-identity assert MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gh-action-pypi-publish v1.14+ writes .publish.attestation sidecar files into packages-dir before uploading. The post-publish assert builds its expected set from dist/ contents, and PyPI serves attestations via the integrity API rather than as distribution files, so the sidecars can never appear in the JSON API's urls[] -- the assert now fails on every release even when the publish is complete and attested. Observed on the v0.10.1 run (32177134404): both distributions matched by sha256 and both files have provenance bundles on the integrity API, but the two sidecar names failed the set comparison twice (initial run and skip-existing re-run). Filter *.publish.attestation from the local set; the distribution set-equality check (including the planted-extra-wheel direction) is unchanged. 🤖 Generated with Claude Code Co-Authored-By: [Claude](mailto:noreply@anthropic.com) --- .github/workflows/release.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8d320964..99771463 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -447,7 +447,16 @@ jobs: sys.exit(0) remote = {u["filename"]: (u.get("digests") or {}).get("sha256") for u in payload.get("urls") or []} - local = sorted(p for p in pathlib.Path("dist").iterdir() if p.is_file()) + # gh-action-pypi-publish v1.14+ writes `.publish.attestation` + # sidecars into packages-dir before upload. PyPI serves attestations + # via the integrity API, never as distribution files, so the sidecars + # must not enter the set-equality comparison below -- with them, this + # assert fails on every release even when the publish is complete and + # attested (observed on the v0.10.1 run). + local = sorted( + p for p in pathlib.Path("dist").iterdir() + if p.is_file() and not p.name.endswith(".publish.attestation") + ) if not local: print("::error::no files in dist/ to compare -- the download-artifact step produced nothing") sys.exit(1)