From 68fb7be64a9e375107de5ed08514539c19289fb0 Mon Sep 17 00:00:00 2001
From: Max Isbey <224885523+maxisbey@users.noreply.github.com>
Date: Mon, 24 Aug 2026 18:47:39 +0000
Subject: [PATCH] Build releases with the pinned build backend and publish with
 an action that accepts current metadata

The release build ran uv 0.9.5, which does not apply
[tool.uv].build-constraint-dependencies to `uv build`, so the hatchling
pin in pyproject.toml never took effect there and the build floated to
hatchling 1.32.0, which writes Metadata-Version 2.5. The publish step was
pinned to gh-action-pypi-publish v1.14.0, whose metadata check predates
2.5 and rejected the distributions before upload.

Use uv 0.12.5 for the build job so the constraint applies (hatchling
1.29.0, Metadata-Version 2.4, matching what 2.0.0 shipped), and move the
publish action to v1.14.2, which also accepts 2.5.

No-Verification-Needed: workflow-only change; reproduced both builds locally
---
 .github/workflows/publish-pypi.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 41b127f923..946ac3db6c 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -21,7 +21,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: false
-          version: 0.9.5
+          version: 0.12.5
 
       - name: Set up Python 3.12
         run: uv python install 3.12
@@ -57,7 +57,7 @@ jobs:
           path: dist/
 
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           # Lets a re-run after a partially failed upload publish the remaining
           # files instead of erroring on the ones already on PyPI.