Fix PyPI publish workflow and wheel build (#322)

* Fix PyPI publish workflow and wheel build

* Avoid duplicate wheel entries while keeping assets

* Restore dtreeviz release note

Author: oegedijk

.github/workflows/upload_to_pypi.yml

@@ -5,6 +5,9 @@ on:
 jobs:
   pypi:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -31,5 +34,3 @@ jobs:
           python3 -m build
       - name: Publish package
         uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          password: ${{ secrets.PYPI_TOKEN }}

RELEASE_NOTES.md

@@ -22,6 +22,7 @@
 - **XGBoost SHAP initialization**: Fixed `base_score` conversion in both `get_params()` and booster's internal JSON configuration to ensure SHAP TreeExplainer initializes correctly with XGBoost 3.1+
 - **RandomForest dtreeviz compatibility**: Fixed dtype handling for `y_train` (now uses `int` instead of `int16`) and observation array conversion for `predict_path()` to work with newer dtreeviz versions
 - **Dtreeviz decisiontree_view**: Ensure observations are passed as numpy arrays to avoid pandas label lookup errors when dtreeviz indexes features by integer position
+- **PyPI packaging**: Removed duplicate wheel entries from hatchling build config to fix "Duplicate filename in local headers" upload errors
 - **Pandas deprecation warnings**: Removed deprecated `pd.option_context("future.no_silent_downcasting")` and `copy=False` parameter from `.infer_objects()` calls
 - **Runtime warnings**: Fixed divide-by-zero warnings in classification plots and residuals plots (log-ratio calculations) by adding proper zero checks and using `np.divide()` with `where` parameter
 

pyproject.toml

@@ -122,10 +122,12 @@ include = [
 ]
 
 [tool.hatch.build.targets.wheel]
-# Ensures package data within the 'explainerdashboard' package is included in the wheel.
-# Hatchling typically includes all files within the package directory that are tracked by VCS.
-# force-include makes this explicit for critical data files.
-# The path on the left is relative to project root (source), path on the right is relative to wheel root (target).
+# Ensure non-Python assets ship in wheels while avoiding duplicate archive entries.
+exclude = [
+    "/explainerdashboard/assets/**",
+    "/explainerdashboard/datasets/**",
+    "/explainerdashboard/static/**",
+]
 
 [tool.hatch.build.targets.wheel.force-include]
 "explainerdashboard/assets" = "explainerdashboard/assets"