[dependabot]

Bumps pypa/gh-action-pypi-publish from 1.14.2 to 1.14.3.

Release notes

Sourced from pypa/gh-action-pypi-publish's releases.

v1.14.3

[!important] 🚨 This release includes fixes for GHSA-5xjx-3w67-w9x9 patched up by @​sethmlarson💰 in #427 and in other places across the ecosystem.

Additional ecosystem and related mitigations beyond you might want to watch out for:

• https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576
• https://emudhra.we-have-a-problem.com

🛠️ Security Tightening

@​webknjaz💰 made sure the dependency tree within the action runtime uses hash-checking from now on via pypa/gh-action-pypi-publish#420.

🪞 Full Diff: pypa/gh-action-pypi-publish@v1.14.2...v1.14.3

🧔‍♂️ Release Manager: @​webknjaz 🇺🇦

💬 Discuss on Bluesky 🦋, on Mastodon 🐘 and on GitHub.

Commits

• 7245906 Merge pull request #427 from sethmlarson/certifi-sigstore
• 331eccb Upgrade certifi and sigstore
• f68fee4 💰 Sync the FUNDING config
• c0d6f8e Merge branch 'integrity/runtime/deptree' into unstable/v1
• 9090099 🧪 Make smoke test deps hash-pinned in CI
• 34e40c2 📌 Bump pip-tools managed transitive deptrees
• e800ed5 👷 Enable hash-checking in the runtime deptree 🔗
• dd8c5f4 🔧 Make pip-tools config available in container
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Workflow-only dependency pin with no application or publish-configuration changes; the bump addresses known security issues in the publish action.

Overview
Pins pypa/gh-action-pypi-publish from v1.14.2 to v1.14.3 (commit 7245906…) in the PyPI and TestPyPI release workflows. Only the publish steps in publish-pypi.yml and publish-testpypi.yml change; build, verify, and release steps are untouched.

v1.14.3 brings security fixes (including advisory GHSA-5xjx-3w67-w9x9) and stricter hash-checking for the action’s runtime dependencies—relevant because these jobs upload release artifacts via trusted publishing.

^{Reviewed by Cursor Bugbot for commit db82080. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Alignment Review Report

Automated Checks

• Lint: N/A — this PR changes only .github/workflows/*.yml; no Python files under src//tests/ are touched, so usort/ruff findings don't apply (and uv isn't available in this sandbox to run lint.sh anyway).
• Debug code: CLEAN for this diff — check-debug.sh does flag some pre-existing print(...) calls and TODOs under src/, but all are unrelated to this PR's two-line workflow change.

Diff Summary

This is a Dependabot bump of the pinned commit SHA for pypa/gh-action-pypi-publish from v1.14.2 → v1.14.3 in both publish-pypi.yml and publish-testpypi.yml. The action is still pinned to a full commit SHA with a human-readable version comment, consistent with supply-chain pinning best practice.

Open RFCs Context

Scanned all RFCs in rfcs/ (000, 001, 002, 003, 004, 005, 006, 008, 010, 011, 012, 014). None address the release/publish workflows or GitHub Actions dependency versions, so there is no active design discussion this change intersects with.

Tier 1: Fixes Required

None — the change is a correctly-formed, SHA-pinned version bump with no syntax, lint, or security issues.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. This touches only CI tooling, not the Gym-like API, MCP boundary, reward computation, or client/server separation covered by PRINCIPLES.md/INVARIANTS.md.

RFC Conflicts

None identified. No open RFC (Draft or In Review) covers the PyPI publish workflow.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

This PR is safe to merge from an alignment standpoint.

  

_{Sent by Cursor Automation: Pre-review}