From 2fdd8d9cdd2da61249edaa7e2de99afbd548b2c9 Mon Sep 17 00:00:00 2001
From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com>
Date: Sat, 10 Oct 2026 06:38:11 +0530
Subject: [PATCH] ci: use published PyPI publisher image tag

---
 .github/workflows/package.yml  | 4 ++--
 tests/test_package_workflow.py | 7 +++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
index b257743..c2fb63d 100644
--- a/.github/workflows/package.yml
+++ b/.github/workflows/package.yml
@@ -326,14 +326,14 @@ jobs:
 
       - name: Publish to TestPyPI
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_target == 'testpypi' }}
-        uses: pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@v1.14.2 # v1.14.2 image tag is required by this composite action
         with:
           packages-dir: dist
           repository-url: https://test.pypi.org/legacy/
 
       - name: Publish to PyPI
         if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || (github.event_name == 'workflow_dispatch' && inputs.publish_target == 'pypi') }}
-        uses: pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@v1.14.2 # v1.14.2 image tag is required by this composite action
         with:
           packages-dir: dist
 
diff --git a/tests/test_package_workflow.py b/tests/test_package_workflow.py
index e4ad821..e564edd 100644
--- a/tests/test_package_workflow.py
+++ b/tests/test_package_workflow.py
@@ -24,6 +24,13 @@ def test_package_workflow_can_recover_an_immutable_tag_from_default_branch() ->
     assert '--source-commit "$SOURCE_COMMIT"' in workflow
 
 
+def test_package_workflow_uses_a_published_pypi_publisher_image_tag() -> None:
+    workflow = (Path(__file__).resolve().parents[1] / ".github/workflows/package.yml").read_text(encoding="utf-8")
+
+    assert workflow.count("uses: pypa/gh-action-pypi-publish@v1.14.2") == 2
+    assert "pypa/gh-action-pypi-publish@a892a5a61159132606e93a2fa6f4358831b04d26" not in workflow
+
+
 def test_package_workflow_does_not_replace_published_release_assets() -> None:
     workflow = (Path(__file__).resolve().parents[1] / ".github/workflows/package.yml").read_text(encoding="utf-8")
     verifier = (Path(__file__).resolve().parents[1] / "scripts/verify_release_assets.py").read_text(encoding="utf-8")