[pedrohcgs]

The first automated DRDID 1.1.7 upload succeeded while PyPI's version endpoint briefly returned a cached 404. With skip-existing, a rapid same-version update could otherwise finish successfully before proving that the public files match the tested build.

Require a read-only check after upload: both public distributions must pass the existing source, metadata and digest validators, and both filenames, URLs and SHA256 digests must appear in PyPI's Simple index. Retry only missing or partially visible publication states, using six attempts with 5, 10, 20, 40 and 60 seconds between them; each request retains its 30-second timeout. Visible mismatches and yanked files fail immediately, and the publish job has a separate 20-minute timeout.

Preserve the tested distributions before the upload action adds attestation sidecars, so the readback keeps the strict two-artifact input contract. Existing CI gates, exact-SHA checkout, OIDC permissions and upload-failure behavior are unchanged. There are no runtime or version changes.

Validation:

• 407 package tests and 100 subtests pass, including cached-404, partial artifact/index visibility, stale same-version source, mismatch and retry-exhaustion cases.
• Actionlint, Python 3.8 syntax validation and git diff --check pass.
• The new command passed a live read-only check of public DRDID 1.1.7 against the independently built candidate distributions.

PyPI uploads files separately. This check cannot roll back a partial upload or prevent an installer from observing one temporarily. Matching partial releases can be retried; different immutable source requires a new version.

Activation verified: merged as a19caaca60f1616acbec9676117807774982c80f; all four main checks passed. Automatic idempotent publisher passed the existing-artifact preflight, exact-main CI recheck, skip-existing upload, candidate snapshot, and public artifact/Simple-index readback. Existing DRDID 1.1.7 SHA256 digests and original upload timestamps remain unchanged. No manual dispatch or rerun was used.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.