ec75d56577
Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.11.0 to 1.12.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/gh-action-pypi-publish/releases">pypa/gh-action-pypi-publish's releases</a>.</em></p> <blockquote> <h2>v1.12.2</h2> <h2>🐛 What's Fixed</h2> <p>The fix for signing legacy zip sdists turned out to be incomplete, so <a href="https://github.com/woodruffw"><code>@woodruffw</code></a><a href="https://github.com/sponsors/woodruffw">💰</a> promptly produced another follow-up that updated <code>pypi-attestations</code> from v0.0.13 to v0.0.15 in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/297">#297</a>. This is the only change since the previous release.</p> <p><strong>🪞 Full Diff</strong>: <a href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.12.1...v1.12.2">https://github.com/pypa/gh-action-pypi-publish/compare/v1.12.1...v1.12.2</a></p> <p><strong>🧔♂️ Release Manager:</strong> <a href="https://github.com/sponsors/webknjaz"><code>@webknjaz</code></a> <a href="https://stand-with-ukraine.pp.ua">🇺🇦</a></p> <h2>v1.12.1</h2> <h2>🐛 What's Fixed</h2> <p>Version v1.12.0 hit several rare corner cases we never considered fully supported, and this release fixes a few of those. In <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/294">#294</a>, <a href="https://github.com/webknjaz"><code>@webknjaz</code></a><a href="https://github.com/sponsors/webknjaz">💰</a> improved the self-hosted runner experience by pre-installing Python if it's not there, and with <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/293">#293</a> the ability to use the action on GitHub Enterprise instances has been restored. The latter should've also fixed the ability to invoke <a href="https://github.com/marketplace/actions/pypi-publish"><code>pypi-publish</code></a> from nested in-repo composite actions — another exotic use-case that was never tested in our CI. <a href="https://github.com/woodruffw"><code>@woodruffw</code></a><a href="https://github.com/sponsors/woodruffw">💰</a> also managed to squeeze in a last-minute fix for detecting legacy <code>.zip</code> sdists while producing attestations via <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/295">#295</a>.</p> <p><strong>🪞 Full Diff</strong>: <a href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.12.0...v1.12.1">https://github.com/pypa/gh-action-pypi-publish/compare/v1.12.0...v1.12.1</a></p> <p><strong>🧔♂️ Release Manager:</strong> <a href="https://github.com/sponsors/webknjaz"><code>@webknjaz</code></a> <a href="https://stand-with-ukraine.pp.ua">🇺🇦</a></p> <p><strong>🙏 Huge Thanks</strong> to all the bug reporters for posting the logs, helping inspect the problems and verify the regression fixes!</p> <h2>v1.12.0</h2> <h2>⚡️ Why Should You Update?</h2> <p>This is a minor version bump, but it does not add any new user-facing interfaces. Still, I felt like it should not be a patch-release: this update brings <em>significant changes</em> to the action invocation and internal release process.</p> <p>Previously, each invocation of <a href="https://github.com/marketplace/actions/pypi-publish"><code>pypi-publish</code></a> required building a container image in the invoking CI job. This was inefficient and added about 30 seconds to the publishing jobs at their startup just to build the container.</p> <p>I wanted to improve this for over three years (<a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/58">#58</a>) and a little over half a year ago <a href="https://github.com/br3ndonland"><code>@br3ndonland</code></a><a href="https://github.com/sponsors/br3ndonland">💰</a> stepped up and offered a very comprehensive solution to the limitation I was hoping to overcome: <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/230">#230</a>.</p> <p>Going forward, I'm going to pre-build per-version containers prior to cutting each release. And the action invocations will just pull the image from GitHub Container registry.</p> <blockquote> <p>[!CAUTION] Known quirks:</p> <ul> <li>This seems to not work on self-hosted runners without a <code>python</code> executable: <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/289">#289</a>. The workaround could be installing it prior to running the action.</li> <li><del>Pinning to commit hashes does not work: <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/290">#290</a>. Workaround: postpone updating until it's fixed or switch to Git tags for now. Subscribe to that issue to follow the progress.</del> <em>UPD:</em> This was an issue during the first 12 hours post release and it has been addressed upstream by publishing a commit SHA-tagged image for the release on Nov 12, 2024 at 10:27 UTC+1.</li> <li>Calling <code>pypi-publish</code> from another nested repo-local composite action might be breaking file paths: <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/291">#291</a>. Workaround: postpone updating until it's fixed. Subscribe to that issue to follow the progress.</li> <li>Running within GitHub Enterprise fails on the action repo clone: <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/292">#292</a>. Workaround: postpone updating until it's fixed. Subscribe to that issue to follow the progress.</li> </ul> </blockquote> <p><strong>🪞 Full Diff</strong>: <a href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.11.0...v1.12.0">https://github.com/pypa/gh-action-pypi-publish/compare/v1.11.0...v1.12.0</a></p> <p><strong>🧔♂️ Release Manager:</strong> <a href="https://github.com/sponsors/webknjaz"><code>@webknjaz 🇺🇦</code></a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href=" |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| workflows | ||
| FUNDING.yml | ||
| SECURITY.md | ||
| dependabot.yml | ||
| release.yml | ||