fix(release): publish only verified wheel

2026-07-27 16:21:57 +00:00
parent fd529a98b5
commit e2857f1eeb
2 changed files with 8 additions and 5 deletions
@@ -127,10 +127,12 @@ The release job operates on one tested commit:
 4. Publish both generic-package artifacts and retain their versions and
   compressed-file checksums.
 5. Generate `release-manifest.json` from those published identities.
-6. Build the wheel/sdist with that manifest.
+6. Build the wheel with that manifest. Do not produce a source distribution:
+   rebuilding an sdist outside this release boundary could replace the pins
+   with the development manifest.
 7. Install the wheel in a clean environment and assert that every manifest
   identity is valid and retrievable.
-8. Publish the Python distribution.
+8. Publish only that verified wheel.

 The build hook receives the manifest as a file input. It must not query a
 registry or choose versions itself: package builds stay deterministic and