From 79fa76754563923860e5165e8740f4b6bd6050ff Mon Sep 17 00:00:00 2001 From: bosd <5e2fd43-d292-4c90-9d1f-74ff3436329a@anonaddy.me> Date: Thu, 8 Oct 2026 00:24:16 +0200 Subject: [PATCH] Remove *.sigstore.json before publishing to PyPI gh-action-sigstore-python v3 writes .sigstore.json bundles, not .sigstore. The cleanup step only removed *.sigstore, so the bundles stayed in dist/ and twine check failed in pypa/gh-action-pypi-publish: InvalidDistribution: Unknown distribution format: '*.sigstore.json'. --- .../{% if extension != 'mypyc' %}release.yml{% endif %}.jinja | 2 +- .../{% if extension == 'mypyc' %}release.yml{% endif %}.jinja | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/template/.github/workflows/{% if extension != 'mypyc' %}release.yml{% endif %}.jinja b/template/.github/workflows/{% if extension != 'mypyc' %}release.yml{% endif %}.jinja index f961c0a..ba8832e 100644 --- a/template/.github/workflows/{% if extension != 'mypyc' %}release.yml{% endif %}.jinja +++ b/template/.github/workflows/{% if extension != 'mypyc' %}release.yml{% endif %}.jinja @@ -91,7 +91,7 @@ jobs: "$TAG_NAME" ./dist/* --repo "$GITHUB_REPOSITORY" - name: Remove sigstore files before publishing to PyPI - run: rm -f dist/*.sigstore + run: rm -f dist/*.sigstore dist/*.sigstore.json - name: Publish package to PyPI uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 {%- endraw %} diff --git a/template/.github/workflows/{% if extension == 'mypyc' %}release.yml{% endif %}.jinja b/template/.github/workflows/{% if extension == 'mypyc' %}release.yml{% endif %}.jinja index ccd4cf2..f90b66d 100644 --- a/template/.github/workflows/{% if extension == 'mypyc' %}release.yml{% endif %}.jinja +++ b/template/.github/workflows/{% if extension == 'mypyc' %}release.yml{% endif %}.jinja @@ -147,6 +147,6 @@ jobs: "$TAG_NAME" ./dist/* --repo "$GITHUB_REPOSITORY" - name: Remove sigstore files before publishing to PyPI - run: rm -f dist/*.sigstore + run: rm -f dist/*.sigstore dist/*.sigstore.json - name: Publish package to PyPI uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1