Release workflow failed on main

[abrichr]

The release workflow failed: https://github.com/OpenAdaptAI/openadapt-evals/actions/runs/33001972150

Until this is fixed, merged fix/feat commits are NOT being published to PyPI, and users install stale versions.

[abrichr]

Root cause

GitPython 3.1.60 removed the Actor.name_email_regex class attribute. Every python-semantic-release version still reads it while loading its config, so the failure hits before any release logic runs:

##[error] type object 'Actor' has no attribute 'name_email_regex'

Upstream has it triaged: #1475, #1476, and fix PR #1477. All three are open. Nothing is released yet.

Why a pinned action broke with no change on our side

.github/workflows/release.yml hasn't changed since the last good run on 2026-08-24 (aca85d4), and the action is pinned by commit SHA. The action is a Docker action (runs: using: docker, image: Dockerfile), so it builds its image on the runner and resolves GitPython at build time. The pin fixes the action's code. It doesn't fix what that code installs.

Bumping the pin will not help

python-semantic-release 10.6.1, the newest release, still declares:

"gitpython ~= 3.0",

That range accepts 3.1.60, so every current release breaks the same way. There's no version to bump to.

The obvious workaround is blocked by our own contract

Upstream suggests pinning gitpython < 3.1.60. We can't do that through the action, because the install happens during the image build and no input reaches it. Doing it on the runner instead (install python-semantic-release plus a constrained GitPython, then call the CLI) would trip tests/test_release_contract.py::test_release_configuration_is_fail_closed, which asserts:

assert "run: uv build" not in workflow
assert "astral-sh/setup-uv" not in workflow
assert "actions/setup-python" not in workflow

That test exists so the release runs inside one pinned container instead of whatever the runner happens to have. Working around the GitPython break on the runner means rewriting that contract, not patching a step.

Two paths that actually work

1. Finish ci: protect release and lifecycle workflows #296. It replaces this workflow and drops python-semantic-release entirely, so the broken dependency stops mattering. It's still a draft, and it needs the OPENADAPT_RELEASE_APP_* and OPENADAPT_LIFECYCLE_APP_* variables and secrets to exist before it can run.
2. Wait for upstream #1477 to ship, then bump the pin. Lower effort, but the timing isn't ours to control.

Impact while this is open

PyPI is at 0.92.0. Two merged commits are unpublished:

• feat(evidence): publish the Flow 1.33.0 comparison; supersede 1.32.0 #297, feat(evidence): publish the Flow 1.33.0 comparison; supersede 1.32.0
• fix(evidence): verify private Cloud attestations on GitHub's instance #293, fix(evidence): verify private Cloud attestations on GitHub's instance

Neither is urgent for users. One is evidence documentation, the other fixes a code path that import_files() still refuses to reach. So the stale-version risk here is smaller than it usually is, but the tag and version history stay frozen until one of the two paths above lands.