fix(ci): inline the PyPI publish step instead of a composite action - #93
Merged
Conversation
pypa/gh-action-pypi-publish is a Docker container action. Nested inside reqstool/.github's actions/publish-to-pypi composite action, GitHub resolved its image using the composite action's own repo and pinned ref instead of the Docker action's, and every real publish failed with `docker: invalid reference format`. The action's own maintainers say this usage is untested and unsupported. Both steps -- download-artifact and the actual publish -- are now inline, matching the pattern the upstream workaround comment already showed (see reqstool/.github#95 for the full writeup). There is no shared action for this step in the org at all now; what remained after removing the publish call wasn't enough to justify one. Needs reqstool/.github#94 merged first. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
Reworks the previous commit. Composite actions were not the problem -- one creates no new workflow context, so the job keeps this repo's own OIDC identity, which is why it works where a reusable workflow does not. Only pypa/gh-action-pypi-publish had to come out of it, because nesting a Docker container action makes GitHub resolve its image against the wrapping action's repository. So the download goes back to a shared action, renamed download-dists now that it no longer publishes, and only the publish step stays inline. Still pinned at @main here; reqstool/.github#94 has to merge before a commit SHA exists to pin to. That pin lands before this PR merges. Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| id-token: write | ||
| steps: | ||
| - uses: reqstool/.github/.github/actions/publish-to-pypi@b10b898cd5a1d552a578dbe4f170f84fb8f98b6c # main 2026-08-23 | ||
| - uses: reqstool/.github/.github/actions/download-dists@main |
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Companion to reqstool/.github#94 — see
reqstool/.github#95, including the
corrections in the second comment.
Today's real release run failed at
publish-to-pypi:pypa/gh-action-pypi-publishis a Docker container action, and nesting one inside acomposite action makes GitHub resolve its image against the wrapping action's repository
rather than its own. Its own maintainer
describes the same breakage.
The composite action itself was fine — it creates no new workflow context, so the job keeps
this repo's own OIDC identity, which is why it works where a cross-repo reusable workflow
does not. So only the publish step comes out.
What changes
download-distsisactions/publish-to-pypirenamed — it no longer publishes.Needs reqstool/.github#94 merged first, and the
@mainreference gets pinned to a commitSHA before this merges (no SHA exists to pin to until #94 lands).
Checklist
git commit -s).Test plan
YAML validated locally. The real test is a dispatch reaching a successful
publish-to-pypi—no local check catches this class of bug.