Bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.3 #391
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.9.0 to 1.10.3. - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@ec4db0b...f760068) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #391 +/- ##
=======================================
Coverage 77.83% 77.83%
=======================================
Files 68 68
Lines 8647 8647
=======================================
Hits 6730 6730
Misses 1917 1917 ☔ View full report in Codecov by Sentry. |
|
@jbms I see you added this repo's CI to the trusted publishers list in both test-pypi and pypi. We have been getting this warning in the CI logs:
With the changes to the gh-action-pypi-publish, this warning will show as a job summary. Are you ok with removing the |
|
Sure |
|
yeah for provenance and all that 🤓 |
dependabot
bot
deleted the
dependabot/github_actions/pypa/gh-action-pypi-publish-1.10.3
branch
|
Its failing to publish with the current trusted publisher config (set via pypi or test-pypi UI):
I don't think it has something to do with my credentials pushing the tag. I cannot inspect the trusted publisher config in pypi UI. I'm seeing the same warning when publishing to test-pypi also. |
I mistakenly thought this meant trusted publisher was set up in pypi: |
|
@jbms If you want to "invite" me to the pypi project, I'll set up the trusted publisher for this repo's CI. Same would need to be repeated for test-pypi. PS- I'm using the same username on pypi and test-pypi: 2bndy5 |
|
I can do that but probably easier to just use the token for now. |
|
ok I'll revert the CI. |
Bumps pypa/gh-action-pypi-publish from 1.9.0 to 1.10.3.
Release notes
Sourced from pypa/gh-action-pypi-publish's releases.
... (truncated)
Commits
f760068Merge pull request #271 from mosfet80/patch-36edc294Fix node.js v16 deprecation self-smoke-test-action.yml85a5a80Merge pull request #270 from trail-of-forks/fix-magic-link-summary954318bMerge pull request #267 from mosfet80/patch-224791c7Merge pull request #266 from mosfet80/patch-1d8c8948Fix magic link nudge formatting in job summarya1ce384Check for Trusted Publishing in magic link logic00b87c8Update check-jsonschema and pre-commit libsa571f1eUpdate pylint lib897895fMerge pull request #262 from trail-of-forks/ww/bump-attestations-reqMost Recent Ignore Conditions Applied to This Pull Request
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)