From 9de4c0290290dd908da47c9e23688822f4e25bfa Mon Sep 17 00:00:00 2001 From: Thang Luu <76550342+thangldw@users.noreply.github.com> Date: Sun, 23 Aug 2026 15:58:30 +0900 Subject: [PATCH] fix: use published PyPI container action ref --- .github/workflows/publish-pypi.yml | 3 ++- tests/test_github_workflows.py | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index 9907486..5655814 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -61,4 +61,5 @@ jobs: test "$(find release-assets -maxdepth 1 -name 'ragops-*.tar.gz' | wc -l)" -eq 1 cp release-assets/ragops-*.whl release-assets/ragops-*.tar.gz dist/ - name: Publish distributions with Trusted Publishing - uses: pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26 # v1.14.2 + # Upstream container images are published for exact release tags, not commit-SHA refs. + uses: pypa/gh-action-pypi-publish@v1.14.2 diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py index 0f063c0..7aaa2f1 100644 --- a/tests/test_github_workflows.py +++ b/tests/test_github_workflows.py @@ -9,7 +9,7 @@ def test_repository_has_consumer_ci_and_separate_release_publisher() -> None: assert "id-token: write" in workflow assert "environment: pypi" in workflow assert "pull_request" not in workflow - assert "pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26" in workflow + assert "pypa/gh-action-pypi-publish@v1.14.2" in workflow ci = (WORKFLOW_ROOT / "ci.yml").read_text(encoding="utf-8") assert "pull_request:" in ci assert 'python-version: ${{ matrix.python-version }}' in ci