From a565db07d90fce17c708f5006d652da0bb556622 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Mon, 17 Oct 2022 14:10:03 -0400 Subject: [PATCH] workflows/release: sign after publishing ...to avoid trying to upload signing artifacts to PyPI. Signed-off-by: William Woodruff --- .github/workflows/release.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1ab0106..6b29cff 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,14 +28,14 @@ jobs: - name: build run: python -m build - - name: sign - uses: sigstore/gh-action-sigstore-python@v0.0.9 - with: - inputs: ./dist/*.tar.gz ./dist/*.whl - release-signing-artifacts: true - - name: publish uses: pypa/gh-action-pypi-publish@v1.5.1 with: user: __token__ password: ${{ secrets.PYPI_TOKEN }} + + - name: sign + uses: sigstore/gh-action-sigstore-python@v0.0.9 + with: + inputs: ./dist/*.tar.gz ./dist/*.whl + release-signing-artifacts: true