fix(ci): clear TestPyPI attestations before the PyPI publish step

.github/workflows/publish.yml

@@ -73,10 +73,19 @@ jobs:
         # the publisher is registered on test.pypi.org for this repo /
         # workflow / environment.  With no token, `attestations` also
         # takes effect (PEP 740 provenance signatures).
+        # tolerate "file already exists" (e.g. when re-running the workflow
+        # after a partial release), so the PyPI step still runs
+        continue-on-error: true
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           repository-url: https://test.pypi.org/legacy/
           packages-dir: ${{ env.ARTIFACT_DIR }}
+      - name: Remove attestations generated by the TestPyPI publish
+        # the two publish steps share the same dist/ directory; the leftover
+        # *.publish.attestation files would make the PyPI step fail with
+        # "distributions already have publish attestations" (hit during the
+        # bib_lookup v0.2.0 release, fixed there in a7fa7eb)
+        run: rm -f ${{ env.ARTIFACT_DIR }}/*.publish.attestation
       - name: Publish package to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with: