ci: drop third-party actions from the publish workflow

This org enforces a GitHub Actions allowlist, and a disallowed action fails
the *entire workflow* at startup rather than just its own job — that is what
left CI dead for eight days (see PR #50). publish.yml referenced two
non-GitHub actions, `astral-sh/setup-uv` and `pypa/gh-action-pypi-publish`,
either of which could have produced a `startup_failure`. A publish workflow
that cannot start is one that silently never ships, and this one would only
be exercised at the moment of an actual release.

Every `uses:` is now an `actions/*` action. uv is installed from a pinned,
versioned install script and performs the upload itself.

`--trusted-publishing always` rather than `automatic`, so a broken publisher
config fails loudly instead of falling back to hunting for a token.
`--check-url` makes a re-run idempotent, skipping already-uploaded files —
which matters because `fail-fast: false` means a partial publish is a state
we can land in and need to resume from.

The tradeoff is losing PEP 740 attestations: uv uploads them but does not
generate them, and the action that does may not be allowlisted. Provenance
is worth nothing if the workflow cannot start. Documented in RELEASING.md as
something to revisit.

Verified locally: the pinned install script yields exactly uv 0.11.4, and
`uv publish --trusted-publishing always` outside an OIDC environment exits 2
with "No OIDC token discovered" rather than hanging or falling back.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: sklinglernv

.github/workflows/publish.yml

@@ -5,6 +5,13 @@
 # Auth: PyPI Trusted Publishing (OIDC). No API tokens, no repo secrets.
 #
 # `workflow_dispatch` runs the same build against TestPyPI for a dry run.
+#
+# Every `uses:` here is an `actions/*` action, i.e. GitHub-created. That is
+# deliberate: this org enforces an Actions allowlist, and a disallowed action
+# fails the *entire workflow* at startup (see PR #50 — one blocked action left
+# CI dead for 8 days). A publish workflow that cannot start is a publish
+# workflow that silently never ships. uv is installed from a pinned, versioned
+# install script and does the upload itself via `uv publish`.
 name: Publish
 
 on:
@@ -20,6 +27,11 @@ on:
 
 permissions: {}
 
+env:
+  # Pinned: the install script is fetched at runtime, so an unversioned URL
+  # would make every run depend on whatever uv ships that day.
+  UV_VERSION: "0.11.4"
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -29,9 +41,10 @@ jobs:
           fetch-depth: 0  # tags needed for uv-dynamic-versioning
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
-        with:
-          python-version: "3.12"
+        run: |
+          set -euo pipefail
+          curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       # --no-sources: build with `tool.uv.sources` disabled, so the build is
       # exercised the way a non-uv consumer's build backend would see it. Without
@@ -125,10 +138,20 @@ jobs:
           cp dist/"${PKG//-/_}"-* upload/
           test "$(ls upload | wc -l)" -eq 2  # exactly one wheel + one sdist
           ls -l upload
-      - uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          packages-dir: upload/
-          repository-url: https://test.pypi.org/legacy/
+      - name: Install uv
+        run: |
+          set -euo pipefail
+          curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      # --trusted-publishing always: never silently fall back to looking for a
+      # token if the OIDC exchange fails. Fail instead, so a broken publisher
+      # config surfaces as an error rather than an auth prompt.
+      - name: Publish to TestPyPI
+        run: |
+          uv publish --trusted-publishing always \
+            --publish-url https://test.pypi.org/legacy/ \
+            --check-url https://test.pypi.org/simple/ \
+            upload/*
 
   publish-pypi:
     needs: build
@@ -160,9 +183,23 @@ jobs:
           cp dist/"${PKG//-/_}"-* upload/
           test "$(ls upload | wc -l)" -eq 2  # exactly one wheel + one sdist
           ls -l upload
-      - uses: pypa/gh-action-pypi-publish@release/v1
-        with:
-          packages-dir: upload/
+      - name: Install uv
+        run: |
+          set -euo pipefail
+          curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | sh
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      # --trusted-publishing always: never silently fall back to looking for a
+      # token if the OIDC exchange fails. Fail instead, so a broken publisher
+      # config surfaces as an error rather than an auth prompt.
+      #
+      # --check-url makes a re-run idempotent: already-uploaded files are
+      # skipped rather than erroring. Matters because `fail-fast: false` means
+      # a partial publish is a state you can land in and need to resume from.
+      - name: Publish to PyPI
+        run: |
+          uv publish --trusted-publishing always \
+            --check-url https://pypi.org/simple/ \
+            upload/*
 
   # Attach the built wheels to the GitHub Release so `pip install <url>` and
   # air-gapped consumers get the exact artifacts that went to PyPI.

RELEASING.md

@@ -51,11 +51,24 @@ Publishing the release triggers the workflow, which:
 2. Fails the run if the built version does not match the tag, or is a `.devN`
    version (which means the tag was not reachable from the checked-out commit).
 3. Smoke-tests the wheels in a clean venv (imports + `nooa --version`).
-4. Uploads to PyPI via **Trusted Publishing** — no API tokens.
+4. Uploads to PyPI via **Trusted Publishing** (`uv publish`) — no API tokens.
 5. Attaches the wheels and sdists to the GitHub Release.
 
-The upload waits on the `pypi` GitHub Environment, so you can require a manual
-approval there if you want a second pair of eyes before the irreversible step.
+Each upload waits on its `pypi-<package>` GitHub Environment, so a required
+reviewer there gives a second pair of eyes before the irreversible step.
+
+> **Why no third-party actions.** Every `uses:` in `publish.yml` is an
+> `actions/*` action. This org enforces a GitHub Actions allowlist, and a
+> disallowed action fails the *entire workflow* at startup — that is what left
+> CI dead for eight days (PR #50). A publish workflow that cannot start is one
+> that silently never ships, so uv is installed from a pinned install script
+> and does the upload itself.
+>
+> The tradeoff is **no PEP 740 attestations**: `uv publish` uploads them but
+> [does not generate them](https://docs.astral.sh/uv/guides/package/), and the
+> action that does (`pypa/gh-action-pypi-publish`) may not be allowlisted.
+> Worth revisiting if it is added to the allowlist, or once uv can generate
+> them. Trusted Publishing itself is unaffected.
 
 ### Dry run against TestPyPI