CI: Disable attestation for releases for now

With v1.11.0 gh-action-pypi-publish has switched on attestations by default: https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.11.0 According to it's README they are still beta: https://github.com/pypa/gh-action-pypi-publish/blob/fb13cb306901256ace3dab689990e13a5550ffaa/README.md?plain=1#L102 So we will disable attestations for releases to production for now. This way we can still evaluate this supply chain feature in testing, but keep our stable release workflow more stable. Attestations can be enabled for production once they are stable. Signed-off-by: Chris Fiege <[email protected]>
linux-automation · Nov 5, 2024 · c5447a6 · c5447a6
1 parent 45a5993
commit c5447a6
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/.github/workflows/check-and-publish.yaml b/.github/workflows/check-and-publish.yaml
@@ -80,3 +80,5 @@ jobs:
           path: dist/
       - name: Publish distribution package to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: false