fix: publish PyPI wheels from stable release workflow

[alongubkin]

Summary

Move trusted PyPI publishing into the top-level stable release workflow. PyPA's trusted publisher cannot authenticate from a reusable workflow. The protected pypi job now verifies and publishes the qualified wheels before the remaining publication jobs.

Replace the nonexistent PyPA action commit with the verified v1.14.2 commit (dc37677b2e1c63e2034f94d8a5b11f265b73ba33).

Add an optional resume run ID. The stable workflow validates that the prior run was completed on main, its commit is an ancestor with the same version, and every qualification job passed or was intentionally skipped, and all 25 required artifacts are present and unexpired. The current dispatch must also run from main. It then reuses that run's exact qualified artifacts, avoiding conflicts with immutable packages already published from the same commit.

Why

The v3.3.24 publish run stopped before uploading to PyPI because the previous action pin has no GHCR manifest. The previous job also ran inside a reusable workflow, which PyPA does not support for trusted publishing. Other channels already published artifacts, so the retry must reuse the prior qualification rather than build a new release commit.

Verification

• actionlint on both changed workflows (ignoring existing Depot runner labels)
• git diff --check
• Confirmed the pinned action's GHCR manifest exists
• Confirmed the prior run's 36 qualification jobs consist of 26 successes and 10 intentional skips, with all 25 required artifacts unexpired

After merge, resume the stable release with the original qualification run ID.

[alongubkin]

@greptileai please review the workflow changes, including the guarded resume path and PyPI trusted publishing.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge based on the reviewed changes.

Summary

The PR moves trusted PyPI publishing into the top-level stable workflow and adds a way to resume publication from a prior qualification run. The latest push rejects non-main dispatches and checks that all required qualification artifacts remain available before resuming.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Dispatch[Stable dispatch] --> Resolve[Validate main and resolve version]
  Resolve -->|Fresh run| Qualify[Run qualification]
  Resolve -->|Resume run ID| Validate[Validate prior run, jobs and artifacts]
  Qualify --> PyPI[Publish and verify qualified wheels]
  Validate --> PyPI
  PyPI --> Publish[Publish remaining channels]

Loading

_{Reviews (4) · Last reviewed commit: "fix: require complete artifacts before r..."}

[alongubkin]

@greptileai I fixed both findings: the resolver now rejects non-main dispatches before PyPI runs, and the download action in the protected job is pinned to the current v8 commit. Please re-review the latest commit, including the resume validation.

[alongubkin]

@greptileai The latest push rejects non-main dispatches in resolve and now verifies all 25 required, unexpired qualification artifacts before a resume can reach PyPI. Please review the latest commit.