Skip to content

Commit 0397f1f

Browse files
oberstetoberstet
authored
Rel v25.10.2 (#1734)
* new dev branch towards v25.10.2 * Add comprehensive SHA256 verification for native wheels artifacts Fixes #1733, #1732 - Prevents corrupted artifacts from reaching PyPI ## Problem Native wheels (macOS, Windows, Linux no-NVX) had NO checksum verification during artifact transfer from wheels workflow to release workflows. This is the SAME vulnerability that allowed the corrupted v25.10.1 source distribution to reach PyPI (issue #1714). The root cause: all three native wheel artifacts download to the same dist/ directory with files all named CHECKSUMS.sha256, causing them to overwrite each other. Only the last downloaded checksum file remains, leaving most wheels unverified. ## Solution Implemented immediate verification pattern for all three release jobs (release-development, release-nightly, release-stable): 1. Changed from merge-multiple downloads to separate artifact downloads 2. Verify checksums immediately after each download, before the next download overwrites the checksum file 3. Fail fast on any checksum mismatch or missing files ## Coverage ALL artifact transfer pairs now have SHA256 verification: - ✅ Source distributions (wheels → release) - already fixed in prior commit - ✅ macOS ARM64 wheels (wheels → release) - NEW - ✅ Windows x86_64 wheels (wheels → release) - NEW - ✅ Linux no-NVX wheels (wheels → release) - NEW - ✅ Manylinux wheels with NVX (wheels-docker → release) - already existed - ✅ ARM64 wheels with NVX (wheels-arm64 → release) - already existed Complete end-to-end cryptographic chain of custody from build → PyPI. * bump version to 25.10.2 * Reorganize documentation: add Runtime Environment Notes section Fixes #1731 - Adds comprehensive Conda installation guidance ## Changes 1. **New documentation structure** - Created `docs/environments/` directory for environment-specific guides - Added `docs/environments/index.rst` overview page - Moved `autobahn-on-free-threaded-python.rst` → `environments/free-threaded-python.rst` 2. **New Conda documentation** (`docs/environments/conda.rst`) - Explains why conda-forge lags behind PyPI - Recommends `pip install autobahn` within Conda environments - Documents native wheel selection and NVX acceleration - Troubleshooting guide for common Conda issues - Addresses user feedback from issue #1731 3. **Updated references** - Modified `docs/index.rst` to reference new `environments/index` section - Updated reference label from `autobahn-on-free-threaded-python` to `free-threaded-python` ## Why This Structure Consolidates all environment-specific documentation under a single section, making it easier for users to find platform/deployment-specific guidance. Future additions (Docker, embedded systems, etc.) can follow the same pattern. ## Documentation Quality - Follows existing .rst formatting patterns - Includes comprehensive examples and code blocks - Cross-references related documentation pages - Provides troubleshooting sections - Uses consistent section hierarchy Addresses user confusion about installing Autobahn in Conda environments and getting outdated versions from conda-forge. * Integrate cryptographic artifact verification in wheels workflow Updates wheels.yml to use new upload-artifact-verified action from wamp-cicd. ## Changes 1. **Updated .cicd submodule** to bfe9880 (includes new verified artifact actions) 2. **Replaced all upload-artifact@v4 calls** with upload-artifact-verified: - wheels-{platform}-{arch} upload (line 591) - source-distribution upload (line 773, Linux only) - linux-wheels-no-nvx upload (line 781, Linux only) 3. **Simplified upload paths** from file patterns to entire dist/ directory ## Behavior Changes **Before:** - Manual CHECKSUMS.sha256 generation (kept for debugging) - Upload specific files via YAML list pattern - No meta-checksum verification **After:** - Automated CHECKSUMS.sha256 generation by verified action - Upload entire dist/ directory (includes all build outputs) - Auto-generated CHECKSUMS.sha256.meta for integrity verification - Filesystem sync before/after checksum generation ## Files in Uploaded Artifacts Each artifact now includes: - Original build outputs (*.whl, *.tar.gz, *.verify.txt, VALIDATION.txt) - CHECKSUMS.sha256 (generated by action, replaces manual version) - CHECKSUMS.sha256.meta (NEW - enables two-level verification) ## Security Improvement Artifacts now have cryptographic chain-of-custody protection: 1. Build creates files → dist/ 2. verified-upload generates checksums + meta-checksum 3. verified-download verifies meta-checksum → checksums → files 4. Any corruption during artifact transfer is detected This prevents corrupted artifacts (like the PyPy ARM64 wheel in v25.10.1) from reaching the release workflow and ultimately PyPI. Part of fixing #1733, #1732 (chain-of-custody verification). * Replace artifact upload/download with cryptographic chain-of-custody verification This commit integrates the new verified artifact actions from wamp-cicd to replace standard GitHub Actions artifact handling with cryptographically verified transfers that include automatic retry logic for GitHub storage eventual consistency issues. Changes: 1. wheels-docker.yml (line 478-484): - Replaced upload-artifact@v4 with upload-artifact-verified - Changed from file patterns to directory path (wheelhouse/) - Automatic CHECKSUMS.sha256 and meta-checksum generation 2. wheels-arm64.yml (line 414-419): - Replaced upload-artifact@v4 with upload-artifact-verified - Changed from file patterns to directory path (wheelhouse/) - Automatic CHECKSUMS.sha256 and meta-checksum generation 3. release.yml (multiple locations): - Replaced download-artifact@v4 with download-artifact-verified for: * wheels-macos-arm64 (3 occurrences) * wheels-windows-x86_64 (3 occurrences) * source-distribution (3 occurrences) * linux-wheels-no-nvx (3 occurrences) - Removed 12 manual "Re-verify" steps (replaced by built-in verification) - Added max-attempts: 3 and retry-delay: 60 for all downloads - Preserved continue-on-error behavior for optional artifacts Technical improvements: - Two-level cryptographic verification: 1. Meta-checksum verifies CHECKSUMS.sha256 integrity 2. Individual file checksums verify each artifact file - Automatic retry logic with delay handles GitHub Actions storage eventual consistency issues (artifacts marked "completed" before async writes finish) - Filesystem sync before/after checksum generation ensures QEMU buffer flush - Self-contained verification (checksum files travel with artifacts) - Fail-safe design: only succeeds after complete verification Note: Pattern-based downloads (artifacts-*, artifacts-arm64-*) still use standard download-artifact@v4 with merge-multiple because the verified action doesn't yet support pattern matching. These artifacts are protected at upload time by the verified upload actions in wheels-docker.yml and wheels-arm64.yml. Related issues: - Addresses artifact corruption detected in run 18516073936 - Implements solution discussed in issue #1714 * Add comprehensive docstrings for public API attributes Added detailed Sphinx-compatible docstrings for the following public API attributes to improve documentation and developer experience: 1. autobahn.websocket.HAS_NVX - Explains build-time NVX availability check - Documents what NVX provides (UTF-8 validation, XOR masking) - Clarifies independence from AUTOBAHN_USE_NVX runtime setting - Includes usage example and cross-reference to USES_NVX 2. autobahn.websocket.USES_NVX - Explains runtime NVX usage decision - Documents interaction between build-time availability and runtime config - Provides complete AUTOBAHN_USE_NVX environment variable reference - Includes scenario examples and cross-reference to HAS_NVX 3. autobahn.twisted.__ident__ - Enhanced existing brief docstring with comprehensive documentation - Documents format variations (with/without NVX acceleration) - Explains usage in protocol handshakes (WebSocket Upgrade, WAMP HELLO) - Provides example values for different configurations - Cross-references asyncio.__ident__ and USES_NVX 4. autobahn.asyncio.__ident__ - Enhanced existing brief docstring with comprehensive documentation - Documents format variations (with/without NVX acceleration) - Explains usage in protocol handshakes (WebSocket Upgrade, WAMP HELLO) - Notes difference from Twisted variant (no asyncio version number) - Provides example values for different configurations - Cross-references twisted.__ident__ and USES_NVX All docstrings follow reStructuredText format for proper Sphinx rendering in Read the Docs documentation. This is a documentation-only change with no functional modifications. Related: This is a safe change to trigger final workflow testing before merging rel_v25.10.2 to master (addresses issues #1735, #1714).
1 parent 02aef1b commit 0397f1f

File tree

15 files changed

+719
-67
lines changed

15 files changed

+719
-67
lines changed

‎.audit/oberstet_rel_v25.10.2.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
- [ ] I did **not** use any AI-assistance tools to help create this pull request.
2+
- [x] I **did** use AI-assistance tools to *help* create this pull request.
3+
- [x] I have read, understood and followed the projects' [AI Policy](https://github.com/crossbario/autobahn-python/blob/main/AI_POLICY.md) when creating code, documentation etc. for this pull request.
4+
5+
Submitted by: @oberstet
6+
Date: 2025-10-21
7+
Related issue(s): #1733
8+
Branch: oberstet:rel_v25.10.2

‎.cicd‎

‎.github/workflows/release.yml‎

Lines changed: 121 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -122,23 +122,37 @@ jobs:
122122
with:
123123
submodules: recursive
124124

125-
- name: Download all wheel artifacts (from wheels workflow)
126-
uses: actions/download-artifact@v4
125+
- name: Download and verify macOS wheels with retry logic
126+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
127127
with:
128-
pattern: wheels-*
129-
merge-multiple: true
128+
name: wheels-macos-arm64
130129
path: dist/
131130
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
132131
github-token: ${{ secrets.GITHUB_TOKEN }}
132+
max-attempts: 3
133+
retry-delay: 60
133134
continue-on-error: true
134135

135-
- name: Download source distribution
136-
uses: actions/download-artifact@v4
136+
- name: Download and verify Windows wheels with retry logic
137+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
138+
with:
139+
name: wheels-windows-x86_64
140+
path: dist/
141+
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
142+
github-token: ${{ secrets.GITHUB_TOKEN }}
143+
max-attempts: 3
144+
retry-delay: 60
145+
continue-on-error: true
146+
147+
- name: Download and verify source distribution with retry logic
148+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
137149
with:
138150
name: source-distribution
139151
path: dist/
140152
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
141153
github-token: ${{ secrets.GITHUB_TOKEN }}
154+
max-attempts: 3
155+
retry-delay: 60
142156
continue-on-error: true
143157

144158
- name: Debug - List downloaded files
@@ -172,6 +186,7 @@ jobs:
172186
echo ""
173187
174188
HAS_ERRORS=0
189+
TARBALLS_VERIFIED=0
175190
176191
for tarball in dist/*.tar.gz; do
177192
if [ ! -f "$tarball" ]; then
@@ -194,6 +209,8 @@ jobs:
194209
echo "==> Re-verifying: $BASENAME"
195210
echo ""
196211
212+
TARBALLS_VERIFIED=$((TARBALLS_VERIFIED + 1))
213+
197214
# Re-compute SHA256 hash
198215
echo "Computing current SHA256 fingerprint..."
199216
CURRENT_SHA256=$(openssl sha256 "$tarball" | awk '{print $2}')
@@ -286,23 +303,40 @@ jobs:
286303
echo "DO NOT PROCEED WITH RELEASE - investigate and fix first."
287304
echo ""
288305
exit 1
306+
elif [ $TARBALLS_VERIFIED -eq 0 ]; then
307+
echo "======================================================================"
308+
echo "❌ RE-VERIFICATION FAILED - NO SOURCE DISTRIBUTIONS VERIFIED"
309+
echo "======================================================================"
310+
echo ""
311+
echo "Zero source distributions were verified. This means:"
312+
echo " 1. No *.tar.gz files were found in dist/, OR"
313+
echo " 2. Source distribution download from artifacts failed"
314+
echo ""
315+
echo "This is a critical failure - we cannot confirm source distribution integrity."
316+
echo "This was the root cause of issue #1714 (corrupted v25.10.1 on PyPI)."
317+
echo ""
318+
echo "DO NOT PROCEED WITH RELEASE - investigate artifact download!"
319+
echo ""
320+
exit 1
289321
else
290322
echo "======================================================================"
291-
echo "✅ All source distributions re-verified successfully"
323+
echo "✅ All source distributions re-verified successfully ($TARBALLS_VERIFIED tarballs)"
292324
echo "======================================================================"
293325
echo ""
294326
echo "Chain of custody confirmed: wheels workflow → release workflow"
295327
echo "Cryptographic integrity maintained throughout pipeline."
296328
fi
297329
shell: bash
298330

299-
- name: Download Linux wheels without NVX
300-
uses: actions/download-artifact@v4
331+
- name: Download and verify Linux wheels without NVX with retry logic
332+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
301333
with:
302334
name: linux-wheels-no-nvx
303335
path: dist/
304336
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
305337
github-token: ${{ secrets.GITHUB_TOKEN }}
338+
max-attempts: 3
339+
retry-delay: 60
306340
continue-on-error: true
307341

308342
- name: Download manylinux wheel artifacts (from wheels-docker workflow)
@@ -783,23 +817,37 @@ jobs:
783817
with:
784818
submodules: recursive
785819

786-
- name: Download all wheel artifacts (from wheels workflow)
787-
uses: actions/download-artifact@v4
820+
- name: Download and verify macOS wheels with retry logic
821+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
788822
with:
789-
pattern: wheels-*
790-
merge-multiple: true
823+
name: wheels-macos-arm64
791824
path: dist/
792825
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
793826
github-token: ${{ secrets.GITHUB_TOKEN }}
827+
max-attempts: 3
828+
retry-delay: 60
794829
continue-on-error: true
795830

796-
- name: Download source distribution
797-
uses: actions/download-artifact@v4
831+
- name: Download and verify Windows wheels with retry logic
832+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
833+
with:
834+
name: wheels-windows-x86_64
835+
path: dist/
836+
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
837+
github-token: ${{ secrets.GITHUB_TOKEN }}
838+
max-attempts: 3
839+
retry-delay: 60
840+
continue-on-error: true
841+
842+
- name: Download and verify source distribution with retry logic
843+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
798844
with:
799845
name: source-distribution
800846
path: dist/
801847
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
802848
github-token: ${{ secrets.GITHUB_TOKEN }}
849+
max-attempts: 3
850+
retry-delay: 60
803851
continue-on-error: true
804852

805853
- name: Debug - List downloaded files
@@ -833,6 +881,7 @@ jobs:
833881
echo ""
834882
835883
HAS_ERRORS=0
884+
TARBALLS_VERIFIED=0
836885
837886
for tarball in dist/*.tar.gz; do
838887
if [ ! -f "$tarball" ]; then
@@ -855,6 +904,8 @@ jobs:
855904
echo "==> Re-verifying: $BASENAME"
856905
echo ""
857906
907+
TARBALLS_VERIFIED=$((TARBALLS_VERIFIED + 1))
908+
858909
# Re-compute SHA256 hash
859910
echo "Computing current SHA256 fingerprint..."
860911
CURRENT_SHA256=$(openssl sha256 "$tarball" | awk '{print $2}')
@@ -947,23 +998,40 @@ jobs:
947998
echo "DO NOT PROCEED WITH RELEASE - investigate and fix first."
948999
echo ""
9491000
exit 1
1001+
elif [ $TARBALLS_VERIFIED -eq 0 ]; then
1002+
echo "======================================================================"
1003+
echo "❌ RE-VERIFICATION FAILED - NO SOURCE DISTRIBUTIONS VERIFIED"
1004+
echo "======================================================================"
1005+
echo ""
1006+
echo "Zero source distributions were verified. This means:"
1007+
echo " 1. No *.tar.gz files were found in dist/, OR"
1008+
echo " 2. Source distribution download from artifacts failed"
1009+
echo ""
1010+
echo "This is a critical failure - we cannot confirm source distribution integrity."
1011+
echo "This was the root cause of issue #1714 (corrupted v25.10.1 on PyPI)."
1012+
echo ""
1013+
echo "DO NOT PROCEED WITH RELEASE - investigate artifact download!"
1014+
echo ""
1015+
exit 1
9501016
else
9511017
echo "======================================================================"
952-
echo "✅ All source distributions re-verified successfully"
1018+
echo "✅ All source distributions re-verified successfully ($TARBALLS_VERIFIED tarballs)"
9531019
echo "======================================================================"
9541020
echo ""
9551021
echo "Chain of custody confirmed: wheels workflow → release workflow"
9561022
echo "Cryptographic integrity maintained throughout pipeline."
9571023
fi
9581024
shell: bash
9591025

960-
- name: Download Linux wheels without NVX
961-
uses: actions/download-artifact@v4
1026+
- name: Download and verify Linux wheels without NVX with retry logic
1027+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
9621028
with:
9631029
name: linux-wheels-no-nvx
9641030
path: dist/
9651031
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
9661032
github-token: ${{ secrets.GITHUB_TOKEN }}
1033+
max-attempts: 3
1034+
retry-delay: 60
9671035
continue-on-error: true
9681036

9691037
- name: Download manylinux wheel artifacts (from wheels-docker workflow)
@@ -1461,31 +1529,37 @@ jobs:
14611529
with:
14621530
submodules: recursive
14631531

1464-
- name: Download macOS wheels
1465-
uses: actions/download-artifact@v4
1532+
- name: Download and verify macOS wheels with retry logic
1533+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
14661534
with:
14671535
name: wheels-macos-arm64
14681536
path: dist/
14691537
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
14701538
github-token: ${{ secrets.GITHUB_TOKEN }}
1539+
max-attempts: 3
1540+
retry-delay: 60
14711541
continue-on-error: true
14721542

1473-
- name: Download Windows wheels
1474-
uses: actions/download-artifact@v4
1543+
- name: Download and verify Windows wheels with retry logic
1544+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
14751545
with:
14761546
name: wheels-windows-x86_64
14771547
path: dist/
14781548
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
14791549
github-token: ${{ secrets.GITHUB_TOKEN }}
1550+
max-attempts: 3
1551+
retry-delay: 60
14801552
continue-on-error: true
14811553

1482-
- name: Download source distribution
1483-
uses: actions/download-artifact@v4
1554+
- name: Download and verify source distribution with retry logic
1555+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
14841556
with:
14851557
name: source-distribution
14861558
path: dist/
14871559
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
14881560
github-token: ${{ secrets.GITHUB_TOKEN }}
1561+
max-attempts: 3
1562+
retry-delay: 60
14891563
continue-on-error: true
14901564

14911565
- name: Debug - List downloaded files
@@ -1519,6 +1593,7 @@ jobs:
15191593
echo ""
15201594
15211595
HAS_ERRORS=0
1596+
TARBALLS_VERIFIED=0
15221597
15231598
for tarball in dist/*.tar.gz; do
15241599
if [ ! -f "$tarball" ]; then
@@ -1541,6 +1616,8 @@ jobs:
15411616
echo "==> Re-verifying: $BASENAME"
15421617
echo ""
15431618
1619+
TARBALLS_VERIFIED=$((TARBALLS_VERIFIED + 1))
1620+
15441621
# Re-compute SHA256 hash
15451622
echo "Computing current SHA256 fingerprint..."
15461623
CURRENT_SHA256=$(openssl sha256 "$tarball" | awk '{print $2}')
@@ -1633,23 +1710,40 @@ jobs:
16331710
echo "DO NOT PROCEED WITH RELEASE - investigate and fix first."
16341711
echo ""
16351712
exit 1
1713+
elif [ $TARBALLS_VERIFIED -eq 0 ]; then
1714+
echo "======================================================================"
1715+
echo "❌ RE-VERIFICATION FAILED - NO SOURCE DISTRIBUTIONS VERIFIED"
1716+
echo "======================================================================"
1717+
echo ""
1718+
echo "Zero source distributions were verified. This means:"
1719+
echo " 1. No *.tar.gz files were found in dist/, OR"
1720+
echo " 2. Source distribution download from artifacts failed"
1721+
echo ""
1722+
echo "This is a critical failure - we cannot confirm source distribution integrity."
1723+
echo "This was the root cause of issue #1714 (corrupted v25.10.1 on PyPI)."
1724+
echo ""
1725+
echo "DO NOT PROCEED WITH RELEASE - investigate artifact download!"
1726+
echo ""
1727+
exit 1
16361728
else
16371729
echo "======================================================================"
1638-
echo "✅ All source distributions re-verified successfully"
1730+
echo "✅ All source distributions re-verified successfully ($TARBALLS_VERIFIED tarballs)"
16391731
echo "======================================================================"
16401732
echo ""
16411733
echo "Chain of custody confirmed: wheels workflow → release workflow"
16421734
echo "Cryptographic integrity maintained throughout pipeline."
16431735
fi
16441736
shell: bash
16451737

1646-
- name: Download Linux wheels without NVX
1647-
uses: actions/download-artifact@v4
1738+
- name: Download and verify Linux wheels without NVX with retry logic
1739+
uses: wamp-proto/wamp-cicd/actions/download-artifact-verified@main
16481740
with:
16491741
name: linux-wheels-no-nvx
16501742
path: dist/
16511743
run-id: ${{ needs.check-all-workflows.outputs.wheels_run_id }}
16521744
github-token: ${{ secrets.GITHUB_TOKEN }}
1745+
max-attempts: 3
1746+
retry-delay: 60
16531747
continue-on-error: true
16541748

16551749
- name: Download manylinux wheels with NVX (from wheels-docker)

‎.github/workflows/wheels-arm64.yml‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -411,16 +411,11 @@ jobs:
411411
echo "==> Wheel inventory:"
412412
find wheelhouse/ -name "*.whl" -exec basename {} \; 2>/dev/null | sort || echo "No wheels found"
413413
414-
- name: Upload wheels and build metadata artifacts
415-
uses: actions/upload-artifact@v4
414+
- name: Upload wheels and build metadata with cryptographic verification
415+
uses: wamp-proto/wamp-cicd/actions/upload-artifact-verified@main
416416
with:
417417
name: artifacts-arm64-${{ matrix.target.name }}
418-
path: |
419-
wheelhouse/*.whl
420-
wheelhouse/*.tar.gz
421-
wheelhouse/build-info.txt
422-
wheelhouse/CHECKSUMS.sha256
423-
wheelhouse/VALIDATION.txt
418+
path: wheelhouse/
424419
retention-days: 30
425420

426421
# GitHub Releases, PyPI, and RTD publishing are now handled by the centralized 'release' workflow

‎.github/workflows/wheels-docker.yml‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -476,16 +476,11 @@ jobs:
476476
find wheelhouse/ -name "*.whl" -exec basename {} \; 2>/dev/null | sort || echo "No wheels found"
477477
478478
- name:
479-
Upload wheels, source dist and build metadata artifacts
480-
uses: actions/upload-artifact@v4
479+
Upload wheels, source dist and build metadata with cryptographic verification
480+
uses: wamp-proto/wamp-cicd/actions/upload-artifact-verified@main
481481
with:
482482
name: artifacts-${{ matrix.target.name }}
483-
path: |
484-
wheelhouse/*.whl
485-
wheelhouse/*.tar.gz
486-
wheelhouse/build-info.txt
487-
wheelhouse/CHECKSUMS.sha256
488-
wheelhouse/VALIDATION.txt
483+
path: wheelhouse/
489484
retention-days: 30
490485

491486
# GitHub Releases, PyPI, and RTD publishing are now handled by the centralized 'release' workflow

0 commit comments

Comments
 (0)