From 68c0b77ddb26ba33dae40775053d45c0f2f493e9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:25:40 +0000
Subject: [PATCH 1/5] Initial plan


From 99c8f835b0cdcb61359040c42a4ebcb06119c4fd Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:28:23 +0000
Subject: [PATCH 2/5] Harden release-signing workflow against action resolution
 failures

---
 .github/workflows/publish.yml | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 16616f4..ad98f2c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -56,20 +56,26 @@ jobs:
         - publish-pypi
       runs-on: ubuntu-latest
       permissions:
+        actions: read
         contents: write
         id-token: write
       steps:
         - name: Download artifacts
-          uses: actions/download-artifact@v8.0.1
-          with:
-            name: python-package-distributions
-            path: dist/
+          env:
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          run: >-
+            gh run download
+            '${{ github.run_id }}'
+            --name python-package-distributions
+            --dir dist/
+            --repo '${{ github.repository }}'
+        - name: Install sigstore-python
+          run: python3 -m pip install --upgrade sigstore
         - name: Sign the dists with Sigstore
-          uses: sigstore/gh-action-sigstore-python@v3.4.0
-          with:
-            inputs: >-
-              ./dist/*.tar.gz
-              ./dist/*.whl
+          run: >-
+            python3 -m sigstore sign
+            ./dist/*.tar.gz
+            ./dist/*.whl
         - name: Create GitHub Release
           env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From bfdb40bc0d45f3fa34c792bbc6fbee8ab6646b22 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:29:04 +0000
Subject: [PATCH 3/5] Adjust sigstore signing command to handle artifact globs
 safely

---
 .github/workflows/publish.yml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ad98f2c..0b96867 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -72,10 +72,17 @@ jobs:
         - name: Install sigstore-python
           run: python3 -m pip install --upgrade sigstore
         - name: Sign the dists with Sigstore
-          run: >-
-            python3 -m sigstore sign
-            ./dist/*.tar.gz
-            ./dist/*.whl
+          shell: bash
+          run: |
+            shopt -s nullglob
+            files=(./dist/*.tar.gz ./dist/*.whl)
+            if [ "${#files[@]}" -eq 0 ]; then
+              echo "No distribution artifacts found in ./dist/"
+              exit 1
+            fi
+            for file in "${files[@]}"; do
+              python3 -m sigstore sign "${file}"
+            done
         - name: Create GitHub Release
           env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 61bfcb9fbfe10c1143f486877375a537d6913fa3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:29:39 +0000
Subject: [PATCH 4/5] Add explicit signing progress logs in release workflow

---
 .github/workflows/publish.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0b96867..6c309f4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -80,7 +80,9 @@ jobs:
               echo "No distribution artifacts found in ./dist/"
               exit 1
             fi
+            echo "Found ${#files[@]} distribution artifacts to sign."
             for file in "${files[@]}"; do
+              echo "Signing ${file}"
               python3 -m sigstore sign "${file}"
             done
         - name: Create GitHub Release

From ab0d125092410d0e36d2feadee563b17b4bef7e7 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 13 Jul 2026 13:30:20 +0000
Subject: [PATCH 5/5] Use robust artifact discovery in release signing workflow

---
 .github/workflows/publish.yml | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6c309f4..81eaad9 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -63,19 +63,18 @@ jobs:
         - name: Download artifacts
           env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          run: >-
-            gh run download
-            '${{ github.run_id }}'
-            --name python-package-distributions
-            --dir dist/
-            --repo '${{ github.repository }}'
+          run: |
+            gh run download \
+              '${{ github.run_id }}' \
+              --name python-package-distributions \
+              --dir dist/ \
+              --repo '${{ github.repository }}'
         - name: Install sigstore-python
           run: python3 -m pip install --upgrade sigstore
         - name: Sign the dists with Sigstore
           shell: bash
           run: |
-            shopt -s nullglob
-            files=(./dist/*.tar.gz ./dist/*.whl)
+            mapfile -t files < <(find ./dist -maxdepth 1 -type f \( -name '*.tar.gz' -o -name '*.whl' \) | sort)
             if [ "${#files[@]}" -eq 0 ]; then
               echo "No distribution artifacts found in ./dist/"
               exit 1