Skip to content

Fix 1958 - #2004

Merged
oberstet merged 2 commits into
crossbario:masterfrom
oberstet:fix_1958
Oct 18, 2026
Merged

oberstet merged 2 commits into
crossbario:masterfrom
oberstet:fix_1958

Conversation

@oberstet

Copy link
Copy Markdown
Contributor

fixes #1958

…ns (crossbario#1958)

The release-stable job uploaded with twine and secrets.PYPI_API_TOKEN.
The account-wide PyPI tokens were deleted on 2026-09-29, so the v26.10.1
upload failed with "403 Invalid or non-existent authentication
information" on the first file (nothing reached PyPI).

Replace the twine step with pypa/gh-action-pypi-publish@release/v1, the
same step zlmdb uses (packages-dir dist/, verify-metadata, print-hash,
attestations). The job already has environment pypi and id-token: write,
the Trusted Publisher is registered on PyPI (crossbario/autobahn-python,
release.yml, environment pypi), and check-release-fileset already strips
dist/ to *.whl + *.tar.gz. The twine/packaging installs from git master
in the publish job are gone with it.

Expected CI: green. PR CI does not run release-stable; the change is
exercised by the v26.10.1 release run after landing (release.yml runs
from master via workflow_run).

Note: This work was completed with AI assistance (Claude Code).
@oberstet
oberstet merged commit b7c3646 into crossbario:master Oct 18, 2026
53 checks passed
@oberstet
oberstet deleted the fix_1958 branch October 18, 2026 22:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Publish to PyPI via Trusted Publishing with PEP 740 attestations; retire PYPI_API_TOKEN

1 participant