chore(ci): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 in the actions-minor-and-patch group across 1 directory by dependabot[bot] · Pull Request #1002 · HodeTech/ForgeLM

dependabot · 2026-10-18T09:42:28Z

Bumps the actions-minor-and-patch group with 1 update in the / directory: pypa/gh-action-pypi-publish.

Updates pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

Looking at the diff, you'll only witness updates across the dependency tree. That's it! It's not a security fix or anything like that even, no. But you'll want this update.

[!tip] So what most people will find useful is @takluyver💰's update of Twine to v7 that we use internally (#416). This version will let them upload their sdists and wheels containing core packaging metadata v2.5 to (Test)PyPI.

🧐 Tell me why..

TL;DR non-pure-python projects with C-extensions tend to have dozens (sometimes hundreds) wheels to upload to PyPI per release. They are often quite big and take time to transfer over the network. People started noticing problems and coming up with DIY sharding workarounds like aio-libs/aiohttp#13226 around July 23. On this date, projects with a good amount of bytes to publish would start getting timeouts 5 minutes after the PyPI publishing job begun. The same job that worked just fine before.

I had to start pinging upstream library and ecosystem people, on GitHub and privately, to start making sense of what was happening. Eventually, we collectively concluded that GitHub must've shortened the lifetime of their OIDC identity — it seems to have used to be 10 minutes long (at some point in the past) and is now 5 minutes, apparently. It's not documented clearly, and we have not been able to get any clarity by attempting to contact GitHub through private channels, using personal connections.

Over the course of investigation, @facutuesca💰 found and fixed a related underlying cache invalidation bug in sigstore/sigstore-python#1838, which he then coordinated propagation through the dependency chain updates in sigstore-python, pypi-attestations, gh-action-pypi-publish and gh-action-sigstore-python.

Mike's also discovered that Sigstore's Rekor slowdown seems to have become the main contributing cause of the last week's incident. He's collected some data to support this claim: https://publishing-five-minute-timeout.tiiny.site.

🫶 New Contributors

@davidbrochart made their first contribution in #415

@takluyver made their first contribution in #416

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.1...v1.14.2

🧔‍♂️ Release Manager: @webknjaz 🇺🇦

🙏 Special Thanks to @davidbrochart💰 and @Dreamsorcerer💰 for turning my attention (in #415 and in private) to the newly surfaced corner case in GitHub's behavior that only affected a narrow category of projects while many others remained blissfully unaware. @bdraco💰 came up with a DIY sharding workaround for aiohttp that served as a demo for other projects. @miketheman💰 confirmed the Warehouse-side details. Also, @jku💰 and @woodruffw💰 helped work through, review and release the Sigstore ecosystem upstream libs.

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and [on GitHub][release discussion].

[![GH Sponsors badge]][GH Sponsors URL]

... (truncated)

Commits

dc37677 Merge pull request #417 from trail-of-forks/ft/bump-deps
8b2f234 Bump pypi-attestations and sigstore
78b72db Merge pull request #416 from takluyver/twine-v7
92f4d2a Update twine to v7
ba38be9 Merge pull request #408 from adisivaprasad/bump-setup-python-v6
a6c5088 Bump actions/setup-python from v5.6.0 to v6.2.0
See full diff in compare view

coderabbitai · 2026-10-18T09:42:51Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: c0b3981b-8f6c-47fa-8d46-1a36638a0d2b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

Bumps the actions-minor-and-patch group with 1 update in the / directory: [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish). Updates `pypa/gh-action-pypi-publish` from 1.14.0 to 1.14.2 - [Release notes](https://github.com/pypa/gh-action-pypi-publish/releases) - [Commits](pypa/gh-action-pypi-publish@cef2210...dc37677) --- updated-dependencies: - dependency-name: pypa/gh-action-pypi-publish dependency-version: 1.14.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

…oy-pages 5 and pypi-publish 1.14.2 (#1015) ## Summary Five Dependabot GitHub Actions bumps (#1002, #1004, #1005, #1006, #1009) combined into one pull request so they cost one CI round instead of five (each merge makes the others "behind", and branch protection requires an up-to-date branch). Dependabot closes its own pull requests when the same change lands. The individual commits are merged unchanged. ## Review | Action | Change | Checked | |---|---|---| | `pypa/gh-action-pypi-publish` | `1.14.0` → `1.14.2` (SHA pin) | The new pin `dc37677b…` is the commit of tag `v1.14.2` (dereferenced the annotated tag; the old pin is `v1.14.0`'s). The release only updates the action's own dependency tree (Twine 7, pypi-attestations, sigstore): `action.yml` and `requirements/` change, nothing else | | `actions/checkout` | `v5` → `v7` | v6 stores credentials in a separate file; v7 blocks checking out fork PRs under `pull_request_target`/`workflow_run`. This repository uses neither trigger and no workflow pushes with the persisted credentials | | `actions/setup-python` | `v6` → `v7` | ESM migration, and the `pip-install` input is removed; no workflow passes it (`cache: pip` is unaffected) | | `actions/download-artifact` | `v5` → `v8` | Hash mismatches now fail by default and non-zip artifacts are no longer unzipped; our `dist` artifact is a zip uploaded by `upload-artifact@v5`, which `v8` reads | | `actions/deploy-pages` | `v4` → `v5` | Node 24 runtime and polling back-off only | ### Also in this pull request Every `actions/checkout` step now sets `persist-credentials: false` (11 steps in 5 workflows). CodeRabbit flagged it on the bumped lines; the default stores the workflow token in the git configuration of jobs that then run checked-out code, and no job pushes or fetches with it (the assign-on-comment workflow already did this). ### What CI proves, and what it does not This pull request's own CI exercises `checkout` and `setup-python` (`ci.yml`). The other three live in `publish.yml` and `site-deploy.yml`, which run only on a release tag or a push to `main`, so **they are untested until the next release**. All three fail closed: a broken download or deploy step stops before anything reaches PyPI or the site. If you want certainty first, merge everything except `download-artifact` and `pypi-publish` and try them on a release candidate tag. ## Type - [x] CI / dependency ## Testing - CI (lint, validate, tests on Python 3.10–3.13) on this branch; all workflow files parse; `check_ci_failure_masking` and the guard-wiring tests pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by Sourcery Modernize the repository’s GitHub Actions and harden checkout credential handling across automated workflows. Enhancements: - Upgrade GitHub Actions used across CI, publishing, and deployment workflows to their current major versions. - Disable persisted checkout credentials across workflow jobs to reduce unnecessary token exposure. CI: - Update artifact download, PyPI publishing, and Pages deployment actions to newer releases. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

dependabot · 2026-10-18T11:37:26Z

Looks like pypa/gh-action-pypi-publish is no longer updatable, so this is no longer needed.

dependabot Bot requested a review from cemililik as a code owner October 18, 2026 09:42

dependabot Bot added area: packaging-ci Code area: packaging-ci dependencies Dependency or ecosystem currency labels Oct 18, 2026

dependabot Bot changed the title ~~chore(ci): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 in the actions-minor-and-patch group~~ chore(ci): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 in the actions-minor-and-patch group across 1 directory Oct 18, 2026

dependabot Bot force-pushed the dependabot/github_actions/actions-minor-and-patch-a934d7c76e branch from b77ff3b to 67bc136 Compare October 18, 2026 09:57

cemililik mentioned this pull request Oct 18, 2026

chore(ci): bump checkout 7, setup-python 7, download-artifact 8, deploy-pages 5 and pypi-publish 1.14.2 #1015

Merged

1 task done

dependabot Bot closed this Oct 18, 2026

dependabot Bot deleted the dependabot/github_actions/actions-minor-and-patch-a934d7c76e branch October 18, 2026 11:37

Navigation Menu

Repository navigation

chore(ci): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 in the actions-minor-and-patch group across 1 directory - #1002

chore(ci): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.2 in the actions-minor-and-patch group across 1 directory#1002
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/github_actions/actions-minor-and-patch-a934d7c76e

dependabot Bot commented on behalf of github Oct 18, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Oct 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.14.2

🛠️ Urgh… Another release!? Again? Explain yourself!

🧐 Tell me why..

🫶 New Contributors

Uh oh!

coderabbitai Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

dependabot Bot commented on behalf of github Oct 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 18, 2026 •

edited

Loading

coderabbitai Bot commented Oct 18, 2026 •

edited

Loading