From 892ba58935d0ce0c029cee4c178e73969c647d36 Mon Sep 17 00:00:00 2001
From: Nicola Sella <nsella@redhat.com>
Date: Fri, 5 Sep 2025 12:00:10 +0200
Subject: [PATCH] Remove GH release from pypi workflow

The step to create GH release is clunky, confusing, and fails most of
the time. The code was supposed to be triggered on a new tag, but it's
simpler to create a release from the GH dashboard and let it create the
tag as well, which triggers pypi.

Overall, the workflow mirrors the one from packaging.python.org page
but with few differences:
  - "if" condition in publish-to-test-pypi, to run on main branch only
  - skip-existing test.pypi releases is true to try and reduce the pypi
    usage

https://packaging.python.org/en/latest/guides/
  publishing-package-distribution-releases-using-
  github-actions-ci-cd-workflows/#the-whole-ci-cd-workflow

Signed-off-by: Nicola Sella <nsella@redhat.com>
---
 .github/workflows/publish-to-test-pypi.yml | 52 ++--------------------
 1 file changed, 4 insertions(+), 48 deletions(-)

diff --git a/.github/workflows/publish-to-test-pypi.yml b/.github/workflows/publish-to-test-pypi.yml
index d8f8e07c..4f1e3666 100644
--- a/.github/workflows/publish-to-test-pypi.yml
+++ b/.github/workflows/publish-to-test-pypi.yml
@@ -12,11 +12,12 @@ jobs:
 
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
           python-version: "3.x"
-
       - name: Install pypa/build
         run: >-
           python3 -m
@@ -53,54 +54,9 @@ jobs:
       - name: Publish distribution 📦 to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
 
-  github-release:
-    name: >-
-      Sign the Python 🐍 distribution 📦 with Sigstore
-      and upload them to GitHub Release
-    if: github.repository == 'containers/podman-py'
-    needs:
-      - publish-to-pypi
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: write # IMPORTANT: mandatory for making GitHub Releases
-      id-token: write # IMPORTANT: mandatory for sigstore
-
-    steps:
-      - name: Download all the dists
-        uses: actions/download-artifact@v5
-        with:
-          name: python-package-distributions
-          path: dist/
-      - name: Sign the dists with Sigstore
-        uses: sigstore/gh-action-sigstore-python@v3.0.1
-        with:
-          inputs: >-
-            ./dist/*.tar.gz
-            ./dist/*.whl
-
-      - name: Create GitHub Release
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: >-
-          gh release create
-          '${{ github.ref_name }}'
-          --repo '${{ github.repository }}'
-          --generate-notes
-      - name: Upload artifact signatures to GitHub Release
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        # Upload to GitHub Release using the `gh` CLI.
-        # `dist/` contains the built packages, and the
-        # sigstore-produced signatures and certificates.
-        run: >-
-          gh release upload
-          '${{ github.ref_name }}' dist/**
-          --repo '${{ github.repository }}'
-
   publish-to-testpypi:
     name: Publish Python 🐍 distribution 📦 to TestPyPI
-    if: github.repository == 'containers/podman-py'
+    if: startsWith(github.ref, 'refs/heads/main') && github.repository == 'containers/podman-py'
     needs:
       - build
     runs-on: ubuntu-latest
@@ -122,5 +78,5 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           repository-url: https://test.pypi.org/legacy/
-          skip_existing: true
+          skip-existing: true
           verbose: true