From f40a2aeaf1f535996cdf653abe7f98702987b880 Mon Sep 17 00:00:00 2001 From: Stefan Jansen Date: Sat, 19 Sep 2026 09:49:27 -0400 Subject: [PATCH] fix: provision release verifier dependency Closes #19 --- .github/workflows/release.yml | 2 +- tests/test_release_pipeline.py | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5329717..e0dd512 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -271,7 +271,7 @@ jobs: env: GITHUB_TOKEN: ${{ github.token }} run: >- - uv run --no-project + uv run --no-project --with packaging python scripts/verify_published_release.py --manifest candidate/candidate.json --repository "${{ github.repository }}" diff --git a/tests/test_release_pipeline.py b/tests/test_release_pipeline.py index dfc971c..1544cc8 100644 --- a/tests/test_release_pipeline.py +++ b/tests/test_release_pipeline.py @@ -300,6 +300,12 @@ def artifact_names(job: str, action: str) -> list[str]: assert release["jobs"]["publish"]["needs"] == ["preflight", "documentation"] assert release["jobs"]["github-release"]["needs"] == ["preflight", "publish"] assert release["jobs"]["post-publication"]["needs"] == ["preflight", "github-release"] + published_verification = next( + step["run"] + for step in release["jobs"]["post-publication"]["steps"] + if step.get("name") == "Verify PyPI metadata and GitHub release digests" + ) + assert "uv run --no-project --with packaging" in published_verification def test_external_workflow_actions_use_full_commit_pins() -> None: