From 2dd27c621d8691b71f1d9b9859a9ab246f1f112f Mon Sep 17 00:00:00 2001
From: Gal Shubeli <galshubeli93@gmail.com>
Date: Thu, 16 Jul 2026 13:20:41 +0300
Subject: [PATCH] ci(pypi): drop TestPyPI dry-run gate, publish straight from
 build

Simplify the PyPI publish workflow to build -> publish-pypi. Removes the
publish-testpypi job and repoints publish-pypi's `needs` from
publish-testpypi to build.

Rationale: the TestPyPI stage required a second Trusted Publisher
registration (env `testpypi`) that was never configured, so the 0.3.1
release failed at that gate with `invalid-publisher`. Dropping it leaves a
single publish path needing only the PyPI Trusted Publisher (env `pypi`).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/publish-pypi.yml | 34 ++++--------------------------
 1 file changed, 4 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 40571d48..704a0a38 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -1,13 +1,10 @@
 name: Publish to PyPI
 
 # Builds the queryweaver wheel/sdist ONCE, then publishes that exact artifact
-# via PyPI Trusted Publishing (OIDC) — no API tokens are stored. The same build
-# is validated on TestPyPI as a dry-run gate first, then shipped to PyPI only if
-# that succeeds.
+# to PyPI via Trusted Publishing (OIDC) — no API tokens are stored.
 #
-# One-time setup (see plan): configure a Trusted Publisher on both PyPI and
-# TestPyPI for repo FalkorDB/QueryWeaver, workflow publish-pypi.yml, with the
-# GitHub environments `testpypi` and `pypi` respectively.
+# One-time setup: configure a Trusted Publisher on PyPI for repo
+# FalkorDB/QueryWeaver, workflow publish-pypi.yml, GitHub environment `pypi`.
 
 permissions:
   contents: read
@@ -37,32 +34,9 @@ jobs:
           name: dist
           path: dist/
 
-  publish-testpypi:
-    name: Publish to TestPyPI (dry-run gate)
-    needs: build
-    runs-on: ubuntu-latest
-    environment: testpypi
-    permissions:
-      id-token: write   # required for OIDC trusted publishing
-      contents: read
-    steps:
-      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
-        with:
-          enable-cache: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: dist
-          path: dist/
-      - name: Publish to TestPyPI
-        run: >
-          uv publish
-          --publish-url https://test.pypi.org/legacy/
-          --trusted-publishing always
-          --check-url https://test.pypi.org/simple/
-
   publish-pypi:
     name: Publish to PyPI
-    needs: publish-testpypi
+    needs: build
     runs-on: ubuntu-latest
     environment: pypi
     permissions: