Skip to content

chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 - #1

Merged
n1ckyb merged 1 commit into
release/v0.0.2-rcfrom
dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.2
Aug 9, 2026
Merged

chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2#1
n1ckyb merged 1 commit into
release/v0.0.2-rcfrom
dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2.

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @​takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @​facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

🙏 Special Thanks to @​davidbrochart💰 and @​Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @​bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @​miketheman💰 confirmed the Warehouse-side details. Also, @​jku💰 and @​woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits
  • dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
  • 8b2f234 Bump pypi-attestations and sigstore
  • 78b72db Merge pull request #416 from takluyver/twine-v7
  • 92f4d2a Update twine to v7
  • ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
  • a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
  • See full diff in compare view

@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.2 branch from c45bd9c to d9ea990 Compare August 4, 2026 12:12
@n1ckyb n1ckyb mentioned this pull request Aug 9, 2026
Merged
n1ckyb added a commit that referenced this pull request Aug 9, 2026
@n1ckyb n1ckyb @claude
ci: degrade instead of failing when no token is available (#25)
ed89885 
Every open Dependabot PR in this repo (#1-#5) is red, and none of them for
anything to do with the bumps:

    --from-parser-artifacts needs GH_TOKEN or GITHUB_TOKEN
    ##[error]Process completed with exit code 1

Dependabot PRs and fork PRs receive NO repository secrets - not a redacted value,
an empty string - so the provisioning step hard-fails for a reason the PR author
cannot fix. They were then triaged as "CI failing, hold", which read as a
judgement on the dependencies rather than on our workflow.

Adopts the pattern intentumdiff-core already uses:

  detect  HAS_SPLIT_TOKEN at job level, where secrets ARE readable
          (`secrets.*` cannot be referenced from a step-level `if:`)
  gate    provisioning and the full suite on it
  degrade run what CAN run when the token is absent
  announce ::notice:: saying exactly what was skipped and why

The announcement is not decoration. A quiet reduced gate is indistinguishable
from a full one, and someone will eventually merge on it believing the whole
suite ran. That is the failure this repo already knows: 0.0.1 shipped green
while covering less than it appeared to.

The full gate still runs on every maintainer branch PR and on the base branch, so
nothing merges without it having passed somewhere. The reduced path exists for
people who cannot supply a secret - never as a convenience.

Co-authored-by: n1ckyb <nicknuxton@icloud.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
@n1ckyb
n1ckyb changed the base branch from main to release/v0.0.2-rc August 9, 2026 23:21
n1ckyb @claude
chore(deps): bump pypa/gh-action-pypi-publish
57eb36f 
Rebuilt on the current RC. The branch previously carried an older ci.yml, and a
pull_request run uses the workflow from the PR's own branch - so it ran a version
that predated the no-token degrade handling and failed with
'--from-parser-artifacts needs GH_TOKEN or GITHUB_TOKEN', which Dependabot PRs
can never satisfy because they receive no repository secrets.

Net change against the RC is the pinned SHA only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@n1ckyb
n1ckyb force-pushed the dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.2 branch from d9ea990 to 57eb36f Compare August 9, 2026 23:29
@n1ckyb
n1ckyb merged commit 0dcf2e3 into release/v0.0.2-rc Aug 9, 2026
1 of 2 checks passed
@dependabot
dependabot Bot deleted the dependabot/github_actions/pypa/gh-action-pypi-publish-1.14.2 branch August 9, 2026 23:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@n1ckyb