From 9571b32fcae9f508c2ac21408d1000aa6bb6a59c Mon Sep 17 00:00:00 2001 From: WEN Hao Date: Thu, 29 Oct 2026 10:46:15 +0800 Subject: [PATCH] fix(ci): clear TestPyPI attestations before the PyPI publish step Publishing to TestPyPI and PyPI from the same job shares one dist/ directory; with Trusted Publishing (no token) the TestPyPI upload generates *.publish.attestation files, and the PyPI step then fails with 'distributions already have publish attestations'. This exact failure was hit during the bib_lookup v0.2.0 release (fixed there in a7fa7eb); our publish.yml has the same two-step structure, so apply the same fix ahead of the first torch_ecg trusted-publishing release: remove the attestations between the two steps, and let the TestPyPI step tolerate already-published files so re-runs still reach PyPI. --- .github/workflows/publish.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 70df8564..2b37e841 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -73,10 +73,19 @@ jobs: # the publisher is registered on test.pypi.org for this repo / # workflow / environment. With no token, `attestations` also # takes effect (PEP 740 provenance signatures). + # tolerate "file already exists" (e.g. when re-running the workflow + # after a partial release), so the PyPI step still runs + continue-on-error: true uses: pypa/gh-action-pypi-publish@release/v1 with: repository-url: https://test.pypi.org/legacy/ packages-dir: ${{ env.ARTIFACT_DIR }} + - name: Remove attestations generated by the TestPyPI publish + # the two publish steps share the same dist/ directory; the leftover + # *.publish.attestation files would make the PyPI step fail with + # "distributions already have publish attestations" (hit during the + # bib_lookup v0.2.0 release, fixed there in a7fa7eb) + run: rm -f ${{ env.ARTIFACT_DIR }}/*.publish.attestation - name: Publish package to PyPI uses: pypa/gh-action-pypi-publish@release/v1 with: