chore(ci): support metadata 2.5 publishing

[dependabot]

Summary

• update pypa/gh-action-pypi-publish to v1.14.2 in both publishing workflows
• add a guarded manual retry path for an existing published polymarket-client-v* tag
• keep the recovery scoped to the publishing workflows

Context

The 0.6.0 build emits valid Core Metadata 2.5. The previously pinned publisher rejected that metadata before upload because its Twine version only supported metadata through 2.4. Publisher v1.14.2 adds Metadata 2.5 support.

The retry workflow validates that the requested tag matches polymarket-client-v*, confirms its GitHub release is published, and checks out that immutable tag before building and publishing.

Failed release run: https://github.com/Polymarket/py-sdk/actions/runs/31716824121

Verification

• existing static checks and Python 3.11–3.13 test matrix
• git diff --check
• upstream publisher v1.14.2 release notes: https://github.com/pypa/gh-action-pypi-publish/releases/tag/v1.14.2

[kartojal]

Release recovery update: this branch is now current with main and also pins pypa/gh-action-pypi-publish v1.14.2 (dc37677) in both publishing workflows. v1.14.2 adds support for core metadata 2.5, which blocked the 0.6.0 PyPI upload in run 31716824121 before any files were published.

[kartojal]

Also adds a guarded manual retry to the existing trusted publish.yml: it requires a polymarket-client-v* tag, confirms the GitHub release is published, and checks out that immutable release tag before building. This lets us recover the existing 0.6.0 release without moving or recreating its tag.

[kartojal]

Approved to recover the confirmed polymarket-client 0.6.0 PyPI publication.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1f4f9d5. Configure here.}

[cursor]

Draft release check never fails

Medium Severity

The published-release guard uses gh ... --jq 'select(.isDraft == false)' and discards the result. When the release is a draft, select emits nothing but gh still exits 0, so the step continues and can build and publish from a draft tag via workflow_dispatch.

 

^{Reviewed by Cursor Bugbot for commit 1f4f9d5. Configure here.}