Ensure sigstore signatures are created in dist/ directory

[Copilot]

The sigstore sign command in the publish workflow may create signature files in the current working directory instead of adjacent to the distribution files, causing the upload step to fail when looking for dist/*.sig and dist/*.pem files.

Changes

• Changed to dist/ directory before running sigstore sign to ensure .sig and .pem files are created in the expected location

- name: Sign distributions
  run: |
    cd dist
    sigstore sign *.whl *.tar.gz

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR fixes a bug in the publish workflow where sigstore signature files were potentially being created in the wrong directory, causing the upload step to fail when looking for signature and certificate files.

Key Changes:

• Modified the "Sign distributions" step to change into the dist/ directory before running sigstore sign, ensuring .sig and .pem files are created adjacent to the distribution files

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.