From 067b2a05e20fb77ef0f1daa3407061e68b252be3 Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 20 Aug 2026 06:57:27 -0400 Subject: [PATCH] ci: pin pypa/gh-action-pypi-publish to a commit SHA This workflow referenced the publish action by the floating `release/v1` tag. Every other release pipeline in the org pins a full 40-character commit SHA, so this one could change behaviour with no commit in this repo -- including a change that breaks publishing. That risk is concrete. v1.14.0 bundles twine 6.1.0 and packaging 25.0, which reject Metadata-Version 2.5 -- the version current hatchling emits: InvalidDistribution: Invalid distribution metadata: '2.5' is not a valid metadata version That pin broke the openadapt-evals 0.91.0 release. The tag, the version commit and the GitHub release all landed, then "Publish to PyPI" failed, leaving PyPI stale while every other artifact said the version shipped. Pin v1.14.2 (twine 7.0.0 + packaging 26.2), the version already proven by live uploads of openadapt-privacy 1.0.3 and openadapt-types 0.10.1. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c8570b4..6aa7765 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -82,9 +82,14 @@ jobs: if: steps.release.outputs.released == 'true' run: uv build + # Pinned to a commit SHA, not the floating release/v1 tag, so an upstream + # change cannot alter a release with no commit here. v1.14.2 bundles twine + # 7.0.0 and packaging 26.2, which accept the Metadata-Version 2.5 that current + # hatchling emits. v1.14.0 rejected it and broke the openadapt-evals 0.91.0 + # publish after the tag had already landed. - name: Publish to PyPI if: steps.release.outputs.released == 'true' - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 - name: Publish to GitHub Releases if: steps.release.outputs.released == 'true'