[Release] Configure the exact PyPI Trusted Publisher for RankWeave 0.18.0

[seonghobae]

Incident

The governed v0.18.0 release completed the exact-tag build, full test and 100% coverage gate, wheel/sdist inspection, immutable checksum handoff, and GitHub build-provenance attestation. PyPI upload then failed with invalid-publisher because PyPI found no Trusted Publisher matching the OIDC claims.

Exact observed identity

• PyPI project: rankweave
• GitHub owner: ContextualWisdomLab
• GitHub repository: RankWeave
• Workflow: publish.yml
• Environment: pypi
• OIDC subject: repo:ContextualWisdomLab/RankWeave:environment:pypi
• Workflow ref: ContextualWisdomLab/RankWeave/.github/workflows/publish.yml@refs/tags/v0.18.0
• Release tag: v0.18.0
• Release commit: 61c49c50d3b4a24fc9bd7c6d3a7f2f4ba19d7be6
• Failed publication run: 31067753363

Required external configuration

A PyPI project owner must create or correct a pending/normal Trusted Publisher with the exact identity above. The GitHub pypi environment must remain protected as configured.

Acceptance

• PyPI Trusted Publisher exactly matches owner, repository, workflow, and environment.
• Re-run only the failed publish job from run 31067753363.
• PyPI exposes canonical non-yanked rankweave-0.18.0-py3-none-any.whl and rankweave-0.18.0.tar.gz.
• Both files' SHA-256 values match the immutable workflow handoff.
• PyPI PEP 740 attestations and GitHub build-provenance attestations verify against the exact files.
• Update release evidence and only then upgrade naruon from rankweave==0.1.0.

Security boundary

Do not add a PyPI API token, username/password, skip-existing, alternate registry, PAT, GitHub App private key, or COPILOT_GITHUB_TOKEN fallback. A missing or mismatched Trusted Publisher is a release failure to correct at the external trust configuration.

Authority

• PyPI, Publishing with a Trusted Publisher.
• PyPA, Publishing package distribution releases using GitHub Actions CI/CD workflows.
• PEP 740 / PyPI digital attestations.