From f814fe1af37bdf28678deb0797210ebaccbaf437 Mon Sep 17 00:00:00 2001 From: abrichr Date: Thu, 20 Aug 2026 06:57:17 -0400 Subject: [PATCH] ci: pin pypa/gh-action-pypi-publish to a commit SHA This workflow referenced the publish action by the floating `release/v1` tag. Every other release pipeline in the org pins a full 40-character commit SHA, so this one could change behaviour with no commit in this repo -- including a change that breaks publishing. That risk is concrete. v1.14.0 bundles twine 6.1.0 and packaging 25.0, which reject Metadata-Version 2.5 -- the version current hatchling emits: InvalidDistribution: Invalid distribution metadata: '2.5' is not a valid metadata version That pin broke the openadapt-evals 0.91.0 release. The tag, the version commit and the GitHub release all landed, then "Publish to PyPI" failed, leaving PyPI stale while every other artifact said the version shipped. Pin v1.14.2 (twine 7.0.0 + packaging 26.2), the version already proven by live uploads of openadapt-privacy 1.0.3 and openadapt-types 0.10.1. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 113db20..cf31ad5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,9 +50,14 @@ jobs: uv build python scripts/check_source_boundary.py --require-dist + # Pinned to a commit SHA, not the floating release/v1 tag, so an upstream + # change cannot alter a release with no commit here. v1.14.2 bundles twine + # 7.0.0 and packaging 26.2, which accept the Metadata-Version 2.5 that current + # hatchling emits. v1.14.0 rejected it and broke the openadapt-evals 0.91.0 + # publish after the tag had already landed. - name: Publish to PyPI if: steps.check_skip.outputs.skip != 'true' && steps.release.outputs.released == 'true' - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 - name: Publish to GitHub Releases if: steps.check_skip.outputs.skip != 'true' && steps.release.outputs.released == 'true'