KaifAhmad1andClaude Sonnet 5 f73f599a22 fix(ci): run pypi-publish before Sigstore signing writes to dist/ ...

The v0.6.8 release run failed at the PyPI publish step:

  Checking dist/semantica-0.6.8-py3-none-any.whl.sigstore.json: ERROR
  InvalidDistribution: Unknown distribution format

pypa/gh-action-pypi-publish uploads everything under packages-dir
(default dist/) with no include/exclude filter, so once the Sigstore
signing step (added in #1329) started writing dist/*.sigstore.json
alongside the wheel/sdist, publish was broken for every release from
that point on - it just never ran, since v0.6.7 was tagged two days
before #1329 merged. Confirmed nothing was uploaded to PyPI before
failing (dist/*.whl checked and passed first; the sigstore.json file
failed validation before any upload began).

Fix: run pypi-publish immediately after the package build, before the
Sigstore/attest-build-provenance steps write anything else into dist/.
The GitHub Release upload (which needs the .sigstore.json files) still
runs after signing, unaffected by the reorder.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-05 19:25:51 +05:30

..

benchmark.yml

fix(ci): drop unpinnable benchmarks/requirements.txt install (#1345)

2026-08-31 18:57:28 +05:30

ci.yml

This is resubmit of the pr for issue feat(integrations): add Google ADK support (#1312)

2026-09-04 15:34:48 +05:00

codeql.yml

fix(security): resolve Scorecard vulnerability and token-permission alerts (#1280)

2026-08-30 20:58:39 +05:30

container-scan.yml

fix(docker): split explorer-extra.txt by Python version, fix broken build (#1341)

2026-08-31 17:52:23 +05:30

defender-for-devops.yml

fix(ci): stop checkov's suppressed checks from reopening as new alerts (#1346)

2026-08-31 19:29:24 +05:30

docs.yml

fix(ci): update actions/deploy-pages pin to current v5 (v5.0.1) (#1387)

2026-09-02 13:59:42 +05:00

install-matrix.yml

ci: reusable install action, install-matrix, and release hardening (#1266)

2026-08-30 17:30:21 +05:00

release.yml

fix(ci): run pypi-publish before Sigstore signing writes to dist/

2026-09-05 19:25:51 +05:30

scorecard.yml

ci: reusable install action, install-matrix, and release hardening (#1266)

2026-08-30 17:30:21 +05:00

security-scan.yml

fix(ci): fail-closed detector, merge-base diff, any-depth markdown filter

2026-09-03 12:13:51 +05:30

verify-action-pins.yml

security: SHA-pin all Actions, harden release pipeline, add pin verification (#824)

2026-08-03 19:17:10 +05:30