Disable digital attestation for TestPyPI upload

Signed-off-by: Håkon Wiik Ånes <[email protected]>

.github/workflows/python-publish.yml

@@ -1,3 +1,22 @@
+##
+## Copyright 2019-2025 the orix developers
+##
+## This file is part of orix.
+##
+## orix is free software: you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation, either version 3 of the License, or
+## (at your option) any later version.
+##
+## orix is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+## GNU General Public License for more details.
+##
+## You should have received a copy of the GNU General Public License
+## along with orix. If not, see <http://www.gnu.org/licenses/>.
+##
+
 # This workflow runs when a tagged release is created or it is triggered manually.
 # For more information see:
 # - Python docs: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
@@ -15,7 +34,6 @@ on:
   release:
     types: [published]
   workflow_dispatch:
-    workflow: "*"
 
 jobs:
   deploy:
@@ -24,26 +42,28 @@ jobs:
       # IMPORTANT: this permission is mandatory for trusted publishing
       id-token: write
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     - name: Set up Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
         python-version: '3.x'
 
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip
-        pip install build
+        python -m pip install -U pip
+        python -m pip install build
 
     - name: Build package
       run: |
         python -m build
 
-    - name: Publish package distribution to TestPyPI
+    - name: Publish package to TestPyPI
       uses: pypa/gh-action-pypi-publish@release/v1
+      continue-on-error: true
       with:
-        repository_url: https://test.pypi.org/legacy/
+        repository-url: https://test.pypi.org/legacy/
+        attestations: false
 
-    - name: Publish package distribution to PyPI
+    - name: Publish package to PyPI
       uses: pypa/gh-action-pypi-publish@release/v1