Address more review comments

Author: chrysle

source/guides/github-actions-ci-cd-sample/publish-to-test-pypi.yml

@@ -36,8 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     environment:
       name: pypi
-      # Fill in your project (e.g. repository) name
-      # for <package-name>
+      # Fill in your project (e.g. repository) name for <package-name>
       url: https://pypi.org/p/<package-name>
     permissions:
       id-token: write  # IMPORTANT: mandatory for trusted publishing
@@ -64,21 +63,24 @@ jobs:
       id-token: write  # IMPORTANT: mandatory for sigstore
 
     steps:
-     - name: Sign the dists with Sigstore
-       uses: sigstore/[email protected]
-       with:
-         inputs: >-
-           ./dist/*.tar.gz
-           ./dist/*.whl
-     - name: Upload artifact signatures to GitHub Release
-       # Confusingly, this action also supports updating releases, not
-       # just creating them. This is what we want here, since we've manually
-       # created the release above.
-       uses: softprops/action-gh-release@v1
-       with:
-         # `dist/` contains the built packages, and the
-         # sigstore-produced signatures and certificates.
-         files: dist/**
+    - name: Download all the dists
+      uses: actions/download-artifact@v3
+      with:
+        name: python-package-distributions
+        path: dist/
+    - name: Sign the dists with Sigstore
+      uses: sigstore/[email protected]
+      with:
+        inputs: >-
+          ./dist/*.tar.gz
+          ./dist/*.whl
+    - name: Upload artifact signatures to GitHub Release
+      env:
+        GH_TOKEN: ${{ github.token }}
+      # Upload to GitHub Release using the `gh` CLI.
+      # `dist/` contains the built packages, and the
+      # sigstore-produced signatures and certificates.
+      run: gh release upload "${{ github.ref_name }}" dist/** --repo "${{ github.repository }}"
 
   publish-to-testpypi:
     name: Publish Python 🐍 distribution 📦 to TestPyPI

source/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows.rst

@@ -170,6 +170,14 @@ them to GitHub Release.
    :start-at: github-release:
    :end-before:  publish-to-testpypi
 
+
+.. note::
+
+   This is a replacement for GPG signatures, for which support has been
+   `removed <https://blog.pypi.org/posts/2023-05-23-removing-pgp/>`_ by PyPI.
+   However, this job is not mandatory for defining the workflow.
+
+
 Separate workflow for publishing to TestPyPI
 ============================================
 
@@ -181,10 +189,12 @@ section:
    :language: yaml
    :start-at: publish-to-testpypi
 
-The whole CD workflow
-=====================
+The whole CI/CD workflow
+========================
+
+This paragraph showcases the whole workflow after following the above guide.
 
-.. collapse:: Load file
+.. collapse:: Click here to display the entire GitHub Actions CI/CD workflow definition
 
     .. literalinclude:: github-actions-ci-cd-sample/publish-to-test-pypi.yml
        :language: yaml