From 8d89e58b2c8e6c3956ea335edd852ffc5f3f5d33 Mon Sep 17 00:00:00 2001 From: Kobi Hikri Date: Mon, 13 Jul 2026 13:06:07 +0300 Subject: [PATCH] Restore PEP 740 attestations on release FastAPI's published wheels carried signed provenance up to 0.128.0, but lost it in the migration to uv (#14676, commit b4ba7f46). Verified against PyPI's integrity API: fastapi 0.127.0 -> HTTP 200 (has provenance) fastapi 0.128.0 -> HTTP 200 (has provenance) fastapi 0.129.0 -> HTTP 404 (none) <- first release after the uv migration fastapi 0.139.0 -> HTTP 404 (none) <- latest That migration replaced `pypa/gh-action-pypi-publish` (which emits PEP 740 attestations by default for Trusted Publishing projects) with `uv publish`, whose docs state it "does not currently generate attestations". The OIDC Trusted Publishing identity (`id-token: write`) is still configured, so only the emission step was lost. This keeps `uv build` and hands the upload back to gh-action-pypi-publish, restoring attestation emission. No other change. Co-Authored-By: Claude Fable 5 --- .github/workflows/publish.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 447ce8c33..8c3f04153 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -36,4 +36,9 @@ jobs: - name: Build distribution run: uv build - name: Publish - run: uv publish + # gh-action-pypi-publish emits PEP 740 attestations by default under Trusted + # Publishing; `uv publish` does not generate them. Using it here restores the + # release provenance that fastapi published up to and including 0.128.0. + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 + with: + packages-dir: dist/