Verify a complete PyPI publication

PyPI uploads distribution files one at a time. A failed publishing job can leave a partial release. The publisher should retry the same validated dist directory with skip-existing: true. PyPI keeps files already uploaded and accepts only the missing files. The verification job below checks every published digest, including skipped files.

After publishing, verify the full local distribution against PyPI’s Simple JSON API:

release-creator artifacts \
  --project example --version 1.2.3 --dist dist \
  --wait-seconds 120 > published-urls.txt

The command checks every filename and SHA256 digest, rejects unexpected files and yanked files, and prints one published URL per file. It waits only for an incomplete PyPI listing; changed bytes and malformed responses fail immediately. The command neither uploads files nor uses publishing credentials.

Verify provenance for each published URL in a separate job with pypi-attestations verify pypi --repository. The shared reconcile-pypi-artifacts Action performs both checks.