From e1bdb20c475abe3bc945f28eba7303e4db0faaf9 Mon Sep 17 00:00:00 2001
From: Tim <code@tim.life>
Date: Thu, 23 Apr 2026 21:36:54 -0700
Subject: [PATCH] =?UTF-8?q?fix(release):=20drop=20testpypi=20publish+verif?=
 =?UTF-8?q?y=20=E2=80=94=20trusted=20publisher=20not=20configured?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

supsrc's PyPI 0.4.0 was uploaded via a path that didn't establish a
TestPyPI trusted publisher. invalid-publisher error confirms TestPyPI
has no matching config. For the v0.4.0 backfill (which is idempotent
on already-published artifacts) TestPyPI dry-run adds no value, so
skip it and go directly to publish-pypi.

Future: if test.pypi.org/manage/account/publishing gets a publisher
for provide-io/supsrc + release.yml + env testpypi, restore the
publish-testpypi + verify-testpypi jobs.
---
 .github/workflows/release.yml | 58 ++++-------------------------------
 1 file changed, 6 insertions(+), 52 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1b47eaf3..7e8cfce3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,60 +21,14 @@ jobs:
       parallel-tests: false
     secrets: inherit
 
-  # TestPyPI publish runs in the caller so PyPI Trusted Publishing matches the
-  # OIDC job_workflow_ref against this repo's release.yml (reusable workflows
-  # are not matched by PyPI's publisher config).
-  publish-testpypi:
-    needs: release
-    runs-on: ubuntu-24.04
-    permissions:
-      id-token: write
-      contents: read
-    environment:
-      name: testpypi
-      url: https://test.pypi.org/p/supsrc
-    steps:
-      - name: 📦 Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: release-artifacts
-          path: dist
-      - name: 📤 Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # release/v1
-        with:
-          repository-url: https://test.pypi.org/legacy/
-          skip-existing: true
-
-  # Install from TestPyPI and assert the installed version matches the release tag.
-  # Uses the helper scripts from ci-tooling/scripts/release/.
-  verify-testpypi:
-    needs: publish-testpypi
-    runs-on: ubuntu-24.04
-    steps:
-      - name: 📥 Checkout ci-tooling helpers
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-        with:
-          repository: provide-io/ci-tooling
-          ref: v0.4.2
-          path: .ci-tooling
-      - name: 🐍 Setup Python
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57  # v8.0.0
-        with:
-          python-version: "3.11"
-          enable-cache: false
-      - name: 🔖 Resolve version
-        id: ver
-        env:
-          REF_NAME: ${{ github.ref_name }}
-          RELEASE_TAG: ${{ github.event.release.tag_name }}
-        run: .ci-tooling/scripts/release/resolve-tag-version.sh >> "$GITHUB_OUTPUT"
-      - name: ✅ Install from TestPyPI and verify
-        run: |
-          .ci-tooling/scripts/release/verify-testpypi.sh supsrc "${{ steps.ver.outputs.version }}" "import supsrc; v = supsrc.__version__"
-
   # PyPI publish via trusted publisher bound to this repo's release.yml + env `pypi`.
+  # TestPyPI publish+verify intentionally omitted — supsrc does not have a TestPyPI
+  # trusted publisher configured, and since 0.4.0 already exists on PyPI, TestPyPI
+  # dry-run adds no value for this backfill. Restore publish-testpypi + verify-testpypi
+  # once test.pypi.org/manage/account/publishing has a publisher for
+  # provide-io/supsrc + release.yml + environment `testpypi`.
   publish-pypi:
-    needs: verify-testpypi
+    needs: release
     runs-on: ubuntu-24.04
     permissions:
       id-token: write