attestations: collect *.zip sdists as well

[woodruffw]

The original distribution collection neglected to collect *.zip, which is also valid for source distributions.

See: rzellem/EXOTIC#1344

[webknjaz]

Thanks!

[jpl-jengelke]

Thanks for all the quick help!

Question: When is this stuff released to PyPi production services?

[webknjaz]

@jpl-jengelke this is within the action, not PyPI.

[jpl-jengelke]

Sorry, that was misstated.

Question: How often is the action released/updated and/or how may I use the unstable branch?

(If an update is imminent, we should wait. Otherwise, I wouldn't want to use the unstable branch for long nor modify our workflow file, if possible.)

[webknjaz]

@jpl-jengelke The fix is now released as a part of v1.12.1: #296.

[jpl-jengelke]

Thank you!!! So fast! All of us can aspire to be so efficient!

[webknjaz]

FWIW, today I was fighting a few of more serious regressions from yesterday and didn't have much time due to the day job, which is how this PR happened to make it into the release.. Not sure if this kind of FOSS-life balance is something to aspire to, but I do value good automations that simplify releasing.

[jpl-jengelke]

Ahh ... Still an issue. Is the ZIP file format missing from any configs fed into Pydantic?

...
Status: Downloaded newer image for ghcr.io/pypa/gh-action-pypi-publish:release-v1
Checking dist/exotic-4.2.3-py3-none-any.whl: PASSED
Checking dist/exotic-4.2.3.zip: PASSED
Notice: Generating and uploading digital attestations
Fulcio client using URL: https://fulcio.sigstore.dev/
TUF metadata: /root/.local/share/sigstore-python/tuf/https%3A%2F%2Ftuf-repo-cdn.sigstore.dev
TUF targets cache: /root/.cache/sigstore-python/tuf/https%3A%2F%2Ftuf-repo-cdn.sigstore.dev
Found and verified trusted root
Generating ephemeral keys...
Requesting ephemeral certificate...
Retrieving signed certificate...
Found <Name(O=sigstore.dev,CN=sigstore-intermediate)> as issuer, verifying if it is a ca
attempting to verify SCT with key ID dd3d306ac6c7113263191e1c99673702a24a5eb8de3cadff878a72802f29ee8e
Successfully verified SCT...
Traceback (most recent call last):
  File "/app/attestations.py", line 115, in <module>
    main()
  File "/app/attestations.py", line 111, in main
    attest_dist(dist_path, s)
  File "/app/attestations.py", line 79, in attest_dist
    dist = Distribution.from_file(dist_path)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/root/.local/lib/python3.12/site-packages/pypi_attestations/_impl.py", line 89, in from_file
    return cls(name=name, digest=digest)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/root/.local/lib/python3.12/site-packages/pydantic/main.py", line 176, in __init__
    self.__pydantic_validator__.validate_python(data, self_instance=self)
pydantic_core._pydantic_core.ValidationError: 1 validation error for Distribution
name
  Value error, unknown distribution format: exotic-4.2.3.zip [type=value_error, input_value='exotic-4.2.3.zip', input_type=str]
    For further information visit https://errors.pydantic.dev/2.7/v/value_error
...

Previously we have definitely published ZIPs: (We are trying to push 4.2.3 and this is from 4.2.2.)

[woodruffw]

Ahh ... Still an issue. Is the ZIP file format missing from any configs fed into Pydantic?

Sorry about that -- I know where that issue is. I'll be able to make a fix shortly.

[woodruffw]

#297 will fix this on the GHA side, but I need to perform a similar update to Warehouse as well.

Edit: Warehouse PR: pypi/warehouse#17044

[webknjaz]

@jpl-jengelke I released v1.12.2 with William's fix: #298 / https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.12.2.

Though, you need to wait for pypi/warehouse#17044 to end up in production to see the effect fully. Looks like the deployment progress is displayed @ https://github.com/pypi/warehouse/deployments/pypi.org.