ci(publish): keep the SBOM out of dist/ and add a manual target=pypi republish path
Your AI's guard dog to stop it from going rogue.
Brought to you by:
doberman
Menu
▾
▴
#486 ci(publish): keep the SBOM out of dist/ and add a manual target=pypi republish path
closed
nobody
None
2026-08-27
2026-08-27
Anonymous
No
Originally created by: fu351
PyPI has served 0.18.1 since 2026-08-15: every release run since then failed. Cause one was the trusted publisher on PyPI naming the pre-org-move repo (fixed on PyPI). Cause two is in this repo: the SBOM step from [#402] writes sbom.json into dist/, and pypa/gh-action-pypi-publish uploads everything in dist/, so it fails with Unknown distribution format: 'sbom.json'. This PR moves the SBOM to sbom/ as its own artifact (still attached to the GitHub Release) and adds workflow_dispatch inputs target (testpypi|pypi) and tag so a failed release run can be republished from main — a rerun reuses the old workflow snapshot and cannot pick up the fix. docs/RELEASING.md documents the republish path. After merge: gh workflow run publish.yml -f target=pypi -f tag=v0.18.4.
Related
Ticket changed by: fu351