From 110068a552032b54a0fa74af0e990e5d12324b84 Mon Sep 17 00:00:00 2001 From: Tymofii Pidlisnyi Date: Thu, 20 Aug 2026 09:23:22 -0700 Subject: [PATCH] ci(publish): bump gh-action-pypi-publish to v1.14.2 for metadata 2.5 hatchling now emits Metadata-Version 2.5. The twine bundled in v1.14.0 rejects it with "InvalidDistribution: '2.5' is not a valid metadata version", which is what failed the v2.11.0 tag before any upload happened. v1.14.2 ships twine 7, which accepts 2.5. Pin resolved from the v1.14.2 tag object via the GitHub API, not copied. Signed-off-by: Tymofii Pidlisnyi --- .github/workflows/publish.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 070fc4c..dc43ae2 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -24,6 +24,10 @@ jobs: python -m pip install --upgrade build python -m build - name: Publish to PyPI (Trusted Publishing, PEP 740 attestations) - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + # v1.14.2 or newer is required, not cosmetic: hatchling now emits + # Metadata-Version 2.5, and the twine bundled in v1.14.0 refuses it with + # "InvalidDistribution: '2.5' is not a valid metadata version". v1.14.2 + # ships twine 7, which accepts it. The 2.11.0 tag failed on exactly this. + uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: attestations: true