From 3f90e850017e85e3f563671ba872d35fd1b26c2d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 17 Jul 2026 03:44:32 +0000
Subject: [PATCH] fix(release): build and publish the sdist, harden publish
 workflow

Releases 0.4.0 and 0.4.1 shipped to PyPI with no source distribution
because scripts/build.sh only ran 'python3 -m build . --wheel'. Build
the sdist too, and apply release-workflow hardening:

- name the build artifact explicitly and fail if dist/ is empty
- skip-existing on PyPI publish so re-runs are idempotent
- workflow_dispatch trigger so a run from a tag can backfill files
  missing from an already-published version

Assisted-by: Claude
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HgnKFtXZbCjXNoVNWa5JLd
---
 .github/workflows/publish.yml | 12 ++++++++++--
 scripts/build.sh              |  2 +-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5402100..047df8a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,6 +6,9 @@ on:
     types: [created]
     branches:
       - 'master'
+  # Manual re-publish/backfill: run from a tag to rebuild and upload any
+  # files missing on PyPI for that version (skip-existing keeps the rest).
+  workflow_dispatch:
 
 jobs:
   build:
@@ -28,18 +31,22 @@ jobs:
       - name: Upload build artifacts
         uses: actions/upload-artifact@v4
         with:
+          name: dist-packages
           path: 'dist/*'
+          if-no-files-found: error
 
   upload_pypi:
     name: Upload packages
     needs: ['build']
     runs-on: 'ubuntu-latest'
-    if: github.event_name == 'release' && github.event.action == 'created'
+    if: >-
+      (github.event_name == 'release' && github.event.action == 'created')
+      || github.event_name == 'workflow_dispatch'
     steps:
       - name: Download artifacts
         uses: actions/download-artifact@v4
         with:
-          name: artifact
+          name: dist-packages
           path: dist
 
       - name: Publish package to PyPI
@@ -47,3 +54,4 @@ jobs:
         with:
           user: '__token__'
           password: '${{ secrets.PYPI_API_TOKEN }}'
+          skip-existing: true
diff --git a/scripts/build.sh b/scripts/build.sh
index 43c74ec..d028a86 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -2,5 +2,5 @@
 
 set -x
 
-python3 -m build . --wheel
+python3 -m build .
 twine check dist/*