From f478a90a61079afc5dfdfeaddd30fba736ce63fe Mon Sep 17 00:00:00 2001 From: Michael Zargham Date: Sat, 19 Sep 2026 16:09:06 -0400 Subject: [PATCH] Restore environment: pypi on the publish job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit v0.1.0 published successfully in March from BlockScience/knowledgecomplex with environment: pypi. The May rebrand changed the repository claim GitHub sends, while PyPI's trusted publisher still named the old owner, so publishing began failing with invalid-publisher. #11 read that as an environment problem and removed the environment. That changed which claim was sent but not the one that was wrong, so the next attempt failed identically, now reporting environment: MISSING. The PyPI publisher is being repointed at DynamicalSystemsGroup/knowledgecomplex with environment pypi — the configuration that worked before the rebrand, since the owner was the only thing that ever changed. The pypi environment already exists in this repository's settings, and keeping it keeps the gate: publishing can be restricted to people who should release rather than being available to anyone who can push a tag. --- .github/workflows/publish.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index ab2166e..d4f08d5 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -8,6 +8,11 @@ on: jobs: publish: runs-on: ubuntu-latest + # PyPI's trusted publisher for this project names this environment, and the + # claim GitHub sends has to match it. It is also the gate: publishing can be + # restricted here, to people who should release, rather than being available to + # anyone who can push a tag. + environment: pypi permissions: id-token: write # required for trusted publishing