From 96ead1b097959f2dd3e6bd9ff1ada5c19e5ab769 Mon Sep 17 00:00:00 2001 From: Irfan Ahmad Date: Wed, 15 Jul 2026 16:35:03 +0500 Subject: [PATCH] fix: pin pypa/gh-action-pypi-publish to a commit SHA @release/v1 is a floating branch ref, not a version tag. Your release run on 2026-07-14 failed with "docker: manifest unknown" because that ref resolved to a commit whose Docker image wasn't published on ghcr.io yet (https://github.com/openedx/xblocks-core/actions/runs/29327012856/job/87066591905). The following run happened to succeed once the image caught up, but the underlying race is still there and will fail unpredictably again. Pin to the exact commit backing the current v1.14.0 release instead, consistent with how the rest of this workflow's actions are already pinned. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a55ece66..8546109c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -95,7 +95,7 @@ jobs: path: dist/ - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 with: user: __token__ password: ${{ secrets.PYPI_UPLOAD_TOKEN }}