aio-libs / multidict / 38127370395

86%

push

github

Shard release publishing and signing across a gated matrix (#1768)

<!-- Thank you for your contribution! -->

## What do these changes do?

PyPI's trusted publishing token lives 15 minutes, and the deploy job
reuses one token for every upload. Publishing all 171 dists from one job
takes about 14 minutes, so the first 7.1.0 deploy attempt failed with
`403 Invalid API Token: token is expired` after two PyPI 500s each
stalled an upload for 4 minutes.

This ports aio-libs/aiohttp#13226: `deploy` becomes a matrix of four
groups, each its own job with fresh PyPI and Sigstore tokens and a
disjoint share of the dists, chosen by position in a byte-order sort.
The first group creates the GitHub Release; the others wait for it
before publishing anything. All four target the `pypi` environment, so
they are pending together and one review approves them. Every step stays
idempotent, so a failed group can be re-run on its own. aiohttp uses two
groups; multidict needs four, since it ships roughly twice as many
dists.

## Are there changes in behavior for the user?

No, only the release workflow changes.

## Is it a substantial burden for the maintainers to support this?

No. The group count lives in the `N of M` matrix labels; `RELEASE.md`
describes the four pending jobs and re-running a single group.

## Related issue number

Refs pypa/gh-action-pypi-publish#307, aio-libs/aiohttp#13226.

## Checklist

- [x] I think the code is well written
- [ ] Unit tests for the changes exist; N/A, release workflow change
- [x] Documentation reflects the changes
- [ ] If you provide code modification, please add yourself to
`CONTRIBUTORS.txt`; N/A
- [x] Add a new news fragment into the `CHANGES/` folder
- [x] `make doc-spelling` passes and any new technical words are added
to `docs/spelling_wordlist.txt`

Drafted with Claude Code (Opus 5.5); reviewed by @asvetlov.

<details>
<summary>Agent run details (optional, for reviewers)</summary>

The workflow cannot run without a real tag... (continued)

832 of 1664 branches covered (50.0%)

Branch coverage included in aggregate %.

9757 of 10641 relevant lines covered (91.69%)

1.83 hits per line