From b526d948e671244a9283cf36b1ff32264e413ac0 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 23 Aug 2026 16:12:22 +0200 Subject: [PATCH 1/2] fix(ci): inline the PyPI publish step instead of a composite action pypa/gh-action-pypi-publish is a Docker container action. Nested inside reqstool/.github's actions/publish-to-pypi composite action, GitHub resolved its image using the composite action's own repo and pinned ref instead of the Docker action's, and every real publish failed with `docker: invalid reference format`. The action's own maintainers say this usage is untested and unsupported. Both steps -- download-artifact and the actual publish -- are now inline, matching the pattern the upstream workaround comment already showed (see reqstool/.github#95 for the full writeup). There is no shared action for this step in the org at all now; what remained after removing the publish call wasn't enough to justify one. Needs reqstool/.github#94 merged first. Signed-off-by: Jimisola Laursen --- .github/workflows/release.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 13321b5..172e6b5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -109,9 +109,13 @@ jobs: permissions: id-token: write steps: - - uses: reqstool/.github/.github/actions/publish-to-pypi@b10b898cd5a1d552a578dbe4f170f84fb8f98b6c # main 2026-08-23 + - uses: actions/download-artifact@v8.0.1 with: - artifact: dist-tagged + name: dist-tagged + path: dist + - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 + with: + attestations: true # Last, deliberately. Everything above can fail, and until this runs nothing # resolving "the latest release" can see what was built -- the release is still From 40498208a05d351dfa46faeefacfa47b840d00f5 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 23 Aug 2026 16:26:29 +0200 Subject: [PATCH 2/2] refactor(ci): use download-dists for the artifact half Reworks the previous commit. Composite actions were not the problem -- one creates no new workflow context, so the job keeps this repo's own OIDC identity, which is why it works where a reusable workflow does not. Only pypa/gh-action-pypi-publish had to come out of it, because nesting a Docker container action makes GitHub resolve its image against the wrapping action's repository. So the download goes back to a shared action, renamed download-dists now that it no longer publishes, and only the publish step stays inline. Still pinned at @main here; reqstool/.github#94 has to merge before a commit SHA exists to pin to. That pin lands before this PR merges. Signed-off-by: Jimisola Laursen --- .github/workflows/release.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 172e6b5..0d51839 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -109,10 +109,12 @@ jobs: permissions: id-token: write steps: - - uses: actions/download-artifact@v8.0.1 + - uses: reqstool/.github/.github/actions/download-dists@main with: - name: dist-tagged - path: dist + artifact: dist-tagged + # Inline, not inside download-dists: nesting this Docker action in a + # composite action makes GitHub resolve its image against the wrapper's + # repo. See reqstool/.github#95. - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 with: attestations: true