ci: bump gh-action-pypi-publish to v1.14.2 so publishing accepts Metadata-Version 2.5

[wei-hai]

Bumps pypa/gh-action-pypi-publish from v1.12.4 (Jan 2025) to v1.14.2, so the publish step can accept the wheels the build step produces.

Why

The v0.1.6 publish failed at the upload step:

Checking dist/comfy_sdk-0.1.6-py3-none-any.whl:
ERROR InvalidDistribution: Invalid distribution metadata: '2.5' is not a valid metadata version

The build job installs its tooling unpinned (pip install build twine), so it now builds a wheel carrying Metadata-Version 2.5 and validates it with a current twine — which passes. The publish job then hands that same wheel to the action pinned at v1.12.4, whose bundled packaging predates metadata 2.5 and rejects it.

The two jobs were validating the same artifact with different tooling versions, so the build-time gate structurally could not catch this — twine check passed and the upload failed on the identical file.

Scope

The one-line pin, applied to both the PyPI and TestPyPI steps (same action, same failure mode), plus a comment recording the version floor so the pin doesn't get rolled back.

Deliberately not included: pinning build/twine in the build job. That would also prevent the drift and is arguably the more complete fix, but it's a separate decision about tooling policy and would put the repo on a manual upgrade treadmill — worth its own discussion rather than riding along here.

Verification

The action bump can't be exercised before merge: the publish job only runs on a release event, and workflow_dispatch is a build-only dry run that never reaches it. Checked instead:

• The pin resolves to the real thing — dc37677b2e1c63e2034f94d8a5b11f265b73ba33 is the commit pypa/gh-action-pypi-publish tag v1.14.2 dereferences to.
• YAML still parses.
• Trusted-Publishing setup is untouched; the action's inputs (packages-dir, skip-existing, repository-url) are unchanged between v1.12.4 and v1.14.2, so no call-site changes are needed.

Real verification is the next release publishing successfully.

Follow-up

v0.1.6 is tagged and the GitHub Release is published, but nothing reached PyPI (the failure is pre-upload, so the version number is still unused). Once this merges, the tag and Release need to be recreated at the new main so the publish re-runs against the fixed workflow — the existing tag points at a commit that still carries v1.12.4. @comfyorg/sdk 0.1.6 is already live on npm, so reusing 0.1.6 here keeps the two SDKs in lockstep.

Summary by CodeRabbit

• Chores
  • Updated package publishing workflows to support artifacts using Metadata-Version 2.5.
  • Improved compatibility when publishing releases to PyPI and TestPyPI.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 82dec966-db1a-4023-a66d-56798bbb61bf

📥 Commits

Reviewing files that changed from the base of the PR and between cd8193a and 36a4148.

📒 Files selected for processing (1)

• .github/workflows/publish.yml

---

📝 Walkthrough

Walkthrough

The publish workflow upgrades the PyPI and TestPyPI publishing action to v1.14.2 and documents its compatibility with Metadata-Version 2.5 artifacts.

Changes

Publishing compatibility

Layer / File(s)	Summary
Upgrade package publishing actions .github/workflows/publish.yml	The PyPI and TestPyPI steps now use pypa/gh-action-pypi-publish v1.14.2. Comments document that older versions reject Metadata-Version 2.5 wheels.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: alexisrolland

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the action version update and its purpose: accepting Metadata-Version 2.5 artifacts during publishing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wei/fix-pypi-publish-action-metadata-2-5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}