From 20f9c76a6000f2adeb641df8141eb811feb12980 Mon Sep 17 00:00:00 2001
From: Brett Whynot <brett.whynot@gmail.com>
Date: Thu, 6 Aug 2026 18:06:06 +1000
Subject: [PATCH] ci: disable PyPI attestations for reusable workflow identity
 mismatch

---
 .github/workflows/release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 788dd1d..8cae622 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -78,6 +78,9 @@ jobs:
           path: dist/
       - name: Publish distribution to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          # Reusable workflow: attestations sign under the top-level workflow identity, which PyPI's publisher-identity check rejects with a 400.
+          attestations: false
 
   github-release:
     name: Upload distribution to GitHub Release