Build the sdist and the x86_64 manylinux and musllinux wheels on a
CodeBuild self-hosted runner, then upload them with a PyPI Trusted
Publisher. Authentication is OIDC only, so there is no long-lived token
to store, and nothing is GPG signed: PyPI stopped accepting .asc
signatures in 2023.

Publishing a GitHub Release targets PyPI. A manual dispatch defaults to
TestPyPI with the upload switched off, so a misclick builds and
validates the artifacts without touching an index. The upload sits
behind a GitHub environment named after the target index, which lets
required reviewers gate production without slowing TestPyPI iteration.

Wheels pin manylinux2014 instead of taking the current cibuildwheel
default of manylinux_2_28. Lambda still ships an Amazon Linux 2 base
image on glibc 2.26, which would reject a 2_28 wheel and quietly fall
back to compiling the sdist at install time. Tests run against each
installed wheel inside its target container, so they cover the compiled
runtime_client extension rather than skipping it.

aarch64 wheels are not built yet. Wheels have to be compiled on the
architecture they target and only an x86_64 runner project exists so
far, so arm64 consumers keep compiling from the sdist exactly as they do
today. The matrix carries the rows to restore once an arm64 runner
project is available.

Cut the cibuildwheel interpreter list to cp312 so a dry run finishes in
minutes rather than most of an hour. Every stage still runs; there is
one wheel per libc instead of five.

Restore the full list before shipping a real release.

The check piped tar into grep -q once per required path. grep exits on
its first match, tar keeps writing into the closed pipe and dies on
SIGPIPE, and pipefail then reports the pipeline as failed. The result
was a spurious "Missing ..." for whichever entry matched early enough
to lose the race, while the sdist was in fact complete.

List the archive once into a file and grep the file instead. This also
runs tar once rather than four times, reports every missing entry in one
pass, and dumps the contents on failure.

Point setup.py at awslambdaric-lszecsi so the release workflow can be
exercised end to end against a TestPyPI project that this fork owns,
rather than the real awslambdaric. Revert before opening a PR upstream.

Derive the artifact filename prefix in the workflow instead of hardcoding
awslambdaric. PEP 625 normalises the distribution name in filenames, so
awslambdaric-lszecsi builds awslambdaric_lszecsi-4.0.4.tar.gz and the
sdist and artifact checks were looking for the wrong names.

Note that gh-action-pypi-publish needs a Docker daemon and reachable
ghcr.io, and that the release runners allowlist it, so the hand-rolled
mint-token alternative is a contingency rather than a pending decision.

PIP_INDEX_URL on the job only affects pip on the host. cibuildwheel
builds the container environment explicitly and injects nothing beyond
PIP_DISABLE_PIP_VERSION_CHECK and PIP_ROOT_USER_ACTION, so the installs
that happen inside the build containers, the build frontend and the test
requirements, went straight to PyPI and would fail on a runner with
restricted egress. Pass the variable through with CIBW_ENVIRONMENT_PASS.

Also mask the value before use. A CodeArtifact index URL carries a
bearer token in its userinfo and cibuildwheel echoes the environment it
assembles, which would put the token in a world-readable Actions log on
this public repository.

Replace the action with the Trusted Publisher exchange it performs: fetch
the index's expected audience, request a GitHub OIDC token for it, POST it
to /_/oidc/mint-token, and hand the short-lived project-scoped token to
twine. Authentication is unchanged; there is still no stored credential.

This drops two external dependencies from the release path. The action is
a composite that generates a Docker container action, so it required a
Docker daemon and egress to ghcr.io, and its attestations reached four
Sigstore hosts. Neither is needed now.

The cost is that releases are unsigned. PyPI discards PGP signatures
silently since 2023, and PEP 740 attestations require Sigstore, so there
is no signing option that does not reopen that egress.

Also pin the mirrored build images to the 2026.09.05-1 tag that
cibuildwheel 4.2.1 pins by digest, rather than :latest, and log in to ECR
when the images are sourced from a pull-through cache.

Replace pypa/gh-action-pypi-publish with a direct Trusted Publisher
exchange in scripts/ci/mint_pypi_token.py plus a twine upload. The action
runs as a Docker container pulled from ghcr.io, which the release runners
cannot reach; doing the handshake directly involves no registry and no
container, so the only external host is the index itself.

This drops PEP 740 attestations. The action produced those by signing with
Sigstore, which needs fulcio, rekor, timestamp and tuf-repo-cdn
.sigstore.dev, none of which are on the release runner allowlist. PyPI has
not accepted GPG signatures since 2023, so there is no substitute signing
method: restoring provenance means allowlisting those four hosts.

Also fix the production upload host. PyPI mints tokens at pypi.org but
accepts uploads only at upload.pypi.org, so index_base and upload_url are
now resolved separately. The previous code would have posted a real
release to the wrong host.

Source the build images from an ECR pull-through cache when CIBW_IMAGE_BASE
is set, pinned to a dated pypa tag rather than latest. ECR fetches from
quay.io on its own network, so the runner never needs quay reachable, and
a dated tag is used instead of a digest because a pull-through cache
populates itself by tag on a cold pull.

The mint script uses only the standard library, so it needs no package
index to bootstrap, and its failure paths name the likely cause: a
publisher claim mismatch, a missing id-token permission, or an
unreachable host.