Skip to content

Fix PyPI publish: exclude Sigstore .sigstore.json files from dist/ #161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jacksonpradolima merged 3 commits into from
Jan 1, 2026
Merged

Fix PyPI publish: exclude Sigstore .sigstore.json files from dist/ #161

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
439b0cb
Initial plan
Copilot Jan 1, 2026
5951ac5
Fix PyPI deployment: move Sigstore attestations out of dist directory
Copilot Jan 1, 2026
5d6b36c
Improve error handling when moving Sigstore attestations
Copilot Jan 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions .github/workflows/publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,16 +44,20 @@ jobs:
dist/*.whl
dist/*.tar.gz

- name: Move Sigstore attestations out of dist
run: |
mkdir -p attestations
if ls dist/*.sigstore.json 1> /dev/null 2>&1; then
mv dist/*.sigstore.json attestations/
fi

- name: Upload release assets
uses: softprops/action-gh-release@v2
with:
files: |
dist/*.whl
dist/*.tar.gz
dist/*.whl.sig
dist/*.tar.gz.sig
dist/*.whl.pem
dist/*.tar.gz.pem
attestations/*.sigstore.json
dist/sbom.json

- name: Publish package distributions to PyPI
Expand Down
Loading