ci(release): bring the release pipeline up to parity with provide-foundation

[livingstaccato]

Both failures below were found by provide-foundation's v0.4.3 release, which reached PyPI and left its GitHub release with no artifacts and no signatures. This repository carries identical code and would do the same on its next tag — which matters right now, because 0.4.1 needs cutting to ship #3.

Sigstore — signing aborts

Both signing steps pinned gh-action-sigstore-python at v3.0.0 (July 2024), which installs sigstore ~= 3.0. sigstore-python 3.x bundles a TUF root that can no longer verify Sigstore's production root:

tuf.api.exceptions.UnsignedMetadataError: root was signed by 0/3 keys

raised from TrustedRoot.production() before anything is signed. It does not degrade — it aborts, which is why v0.4.3 ended up with an empty release page.

v3.1.0 moved the action to sigstore-python 4.x for Rekor v2; v3.5.0 is current. rekor-version still defaults to 1 in the action's 3.x series, so bundle format and the dist/*.sigstore.json upload glob are unaffected. Still pinned by SHA, with a note at both call sites.

SBOM — a marker matched as a substring

The closure check demanded every Requires-Dist name appear in the SBOM, skipping only lines containing the literal "extra ==" — a hand-rolled evaluation of one marker, blind to every other. Markers are now evaluated with packaging, against an empty extra, under the venv's own interpreter, since that is the environment the document describes. packaging is installed after generation so it is not published as a component.

This project declares no conditional dependency today, so the check has never misfired here. It is fixed now rather than when the first one is added — which is exactly how provide-foundation found it, mid-release.

Verified

./scripts/sbom_from_wheel.sh against a fresh uv build:

SBOM describes provide-foundry 0.4.0 with 57 dependencies
root: provide-foundry 0.4.0 pkg:pypi/provide-foundry@0.4.0

packaging does appear among the 57 — genuinely, as a transitive dependency. The SBOM is generated before the script installs it, so by construction that is not pollution from this change; provide-foundation's came back with 3 components and no packaging.