From 4d4b3d60081cac1a48c171a74daa9a7c1ca3d528 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Le Borgne Date: Sat, 31 Oct 2026 13:50:31 +0000 Subject: [PATCH] Bump pypa/gh-action-pypi-publish to v1.14.3 v1.14.2 and older trust the emSign ECC Root CA - G3 that Sigstore's trusted publishing chain relied on (GHSA-5xjx-3w67-w9x9, critical, fixed in v1.14.3). Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01GwUvhmzgfkiZ6vo4uGyesN --- .github/workflows/test-publish-py-sdk.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test-publish-py-sdk.yaml b/.github/workflows/test-publish-py-sdk.yaml index 601944585..951469248 100644 --- a/.github/workflows/test-publish-py-sdk.yaml +++ b/.github/workflows/test-publish-py-sdk.yaml @@ -155,7 +155,7 @@ jobs: retention-days: 5 - name: Publish to TestPyPI if: env.DRY_RUN != 'true' && (env.RELEASE_TYPE != 'canary' || (steps.should_publish.outputs.should_publish == 'true' && steps.ci_status.outputs.should_publish == 'true')) - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2 + uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3 with: repository-url: https://test.pypi.org/legacy/ packages-dir: py/dist/