chore: Use shared action to build and publish to allow manual releases.

[kinyoklion]

Summary

Allow manual package publish and provenance.
Working build: https://github.com/launchdarkly/observability-sdk/actions/runs/16377594673/job/46281314100
Published package: https://pypi.org/project/launchdarkly-observability/

How did you test this change?

Are there any deployment considerations?

[cursor]

Bug: Provenance Hash Mismatch in SDK Packages

The provenance hashes for the Python SDK packages are invalid. The action calculates hashes on an initial build, but then removes the dist directory and rebuilds the packages during the poetry publish --build step. This results in the recorded hashes not matching the actual published artifacts, breaking the provenance integrity.

.github/actions/publish-python-sdk/action.yml#L45-L65

observability-sdk/.github/actions/publish-python-sdk/action.yml

Lines 45 to 65 in b552db5

	- name: Build Python plugin
	shell: bash
	working-directory: ${{ inputs.workspace-path }}
	run: |
	make build
	- name: Hash build files for provenance
	id: package-hashes
	shell: bash
	working-directory: ${{ inputs.workspace-path }}/dist
	run: |
	echo "package-hashes=$(sha256sum * | base64 -w0)" >> "$GITHUB_OUTPUT"
	- name: Publish package distributions to PyPI
	working-directory: ${{ inputs.workspace-path }}
	shell: bash
	run: |
	poetry config pypi-token.pypi ${{ env.PYPI_AUTH_TOKEN }}
	rm -rf dist
	poetry publish --build --no-interaction

Fix in Cursor • Fix in Web

---

Was this report helpful? Give feedback by reacting with 👍 or 👎