Bump pypa/gh-action-pypi-publish from 1.8.11 to 1.10.1

Bumps [pypa/gh-action-pypi-publish](https://github.com/pypa/gh-action-pypi-publish) from 1.8.11 to 1.10.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/gh-action-pypi-publish/releases">pypa/gh-action-pypi-publish's releases</a>.</em></p> <blockquote> <h2>v1.10.1</h2> <h2>🚑🔏 Oopsie... We missed a tiny bug in the attestations feature the other day</h2> <p>The problem was that the distribution file validity check was failing on any valid distribution being present and ready to be signed. What a silly mistake! It's now been fixed via <a href="https://github.com/pypa/gh-action-pypi-publish/commit/0ab0b79">https://github.com/pypa/gh-action-pypi-publish/commit/0ab0b79</a>, though. So everything's good!</p> <p>-- <a href="https://github.com/webknjaz"><code>@​webknjaz</code></a><a href="https://github.com/sponsors/webknjaz">💰</a></p> <blockquote> <p>[!IMPORTANT] ✨ Despite this minor hiccup, we invite you to still opt into trying this feature out early. <a href="https://github.com/marketplace/actions/pypi-publish#generating-and-uploading-attestations">It can be enabled</a> like this:</p> <pre lang="yml"><code> with: attestations: true </code></pre> <p>Leave feedback in <a href="https://github.com/pypa/gh-action-pypi-publish/discussions/255">the v1.10.0 release discussion</a> or <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/pull/236">the PR</a>.</p> </blockquote> <p><strong>🪞 Full Diff</strong>: <a href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.10.0...v1.10.1">https://github.com/pypa/gh-action-pypi-publish/compare/v1.10.0...v1.10.1</a></p> <p><strong>🧔‍♂️ Release Manager:</strong> <a href="https://github.com/sponsors/webknjaz"><code>@​webknjaz 🇺🇦</code></a></p> <p><strong>🙏 Special Thanks</strong> to <a href="https://github.com/hugovk"><code>@​hugovk</code></a><a href="https://github.com/sponsors/hugovk">💰</a> for <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/256#issuecomment-2325925847">promptly validating the bug fix</a>, mere minutes after I pushed it — I even haven't finished writing this text by then!</p> <h2>v1.10.0</h2> <h2>🔏 Anything fancy, eh?</h2> <p>This time, <a href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a href="https://github.com/sponsors/woodruffw">💰</a> implemented support for <a href="https://peps.python.org/pep-0740/">PEP 740</a> attestations functionality in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/236">#236</a> and <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/245">#245</a>. This is a big deal, as it is a huge step forward to replacing what the deprecated GPG signatures used to provide in a more meaningful way.</p> <blockquote> <p>[!IMPORTANT] ✨ Please, do opt into trying this feature out early. <a href="https://github.com/marketplace/actions/pypi-publish#generating-and-uploading-attestations">It can be enabled</a> as follows:</p> <pre lang="yml"><code> with: attestations: true </code></pre> <p>Leave any feedback on this in <a href="https://github.com/pypa/gh-action-pypi-publish/discussions/255">this release discussion</a> or <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/pull/236">the PR</a>.</p> </blockquote> <p>🙏 And please, thank William for working on this amazing improvement for the ecosystem! The overall effort is tracked @ <a href="https://redirect.github.com/pypi/warehouse/issues/15871">pypi/warehouse#15871</a>, by the way.</p> <p><strong>🪞 Full Diff</strong>: <a href="https://github.com/pypa/gh-action-pypi-publish/compare/v1.9.0...v1.10.0">https://github.com/pypa/gh-action-pypi-publish/compare/v1.9.0...v1.10.0</a></p> <p><strong>🧔‍♂️ Release Manager:</strong> <a href="https://github.com/sponsors/webknjaz"><code>@​webknjaz 🇺🇦</code></a></p> <h2>v1.9.0</h2> <h2>💅 Cosmetic Output Improvements</h2> <ul> <li><a href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a href="https://github.com/sponsors/woodruffw">💰</a> updated the tense on password nudge in <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/234">#234</a></li> <li><a href="https://github.com/shenxianpeng"><code>@​shenxianpeng</code></a><a href="https://github.com/sponsors/shenxianpeng">💰</a> helped us disable the progress bar that was being produced by the <code>twine upload</code> command via <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/231">#231</a></li> <li><a href="https://github.com/woodruffw"><code>@​woodruffw</code></a><a href="https://github.com/sponsors/woodruffw">💰</a> also linked the PyPI status dashboard in the trusted publishing error message via <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/pull/243">pypa/gh-action-pypi-publish#243</a></li> </ul> <h2>🛠️ Internal Dependencies</h2> <ul> <li>pre-commit linters got auto-updated @ <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/225">#225</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/0ab0b79471669eb3a4d647e625009c62f9f3b241"><code>0ab0b79</code></a> 🚑 Invert the dists-to-attest validity check</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/8a08d616893759ef8e1aa1f2785787c0b97e20d6"><code>8a08d61</code></a> Expose PEP 740 attestations functionality</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/fb9fc6a4e67ca27a7a76b17bbf90be83c2d3c716"><code>fb9fc6a</code></a> Merge pull request <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/245">#245</a> from trail-of-forks/ww/bump-twine</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/4d020ff0a95865600010678657968f3f265f267d"><code>4d020ff</code></a> requirements: re-compile requirements with latest twine</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0"><code>ec4db0b</code></a> Merge PR <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/243">#243</a> into unstable/v1</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/e7908444c66f5eb9b434207e3ecfef975ea3294e"><code>e790844</code></a> oidc-exchange: link to status dashboard</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/87b624f8716b1150d93f45fa364e49eceebf3ffd"><code>87b624f</code></a> 💅Update homepage @ Dockerfile to GH Marketplace</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/da2f9bb91e4befc116f611d2977e267bfc852706"><code>da2f9bb</code></a> Merge pull request <a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/241">#241</a> from br3ndonland/ghcr-label</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/abbea2dd5c5802d41c4b6d88c355c64e10207278"><code>abbea2d</code></a> Add Docker label for GHCR</li> <li><a href="https://github.com/pypa/gh-action-pypi-publish/commit/2734d07314198e3efbc2a559db0dd8ee41311611"><code>2734d07</code></a> build(deps): bump requests from 2.31.0 to 2.32.0 in /requirements (<a href="https://redirect.github.com/pypa/gh-action-pypi-publish/issues/240">#240</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pypa/gh-action-pypi-publish/compare/2f6f737ca5f74c637829c0f5c3acd0e29ea5e8bf...0ab0b79471669eb3a4d647e625009c62f9f3b241">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>