Fix release artifact handling for upload-artifact@v4 (would drop wheels/sdist on next release)

[wbarnha]

Description

The release workflow can publish an incomplete set of files (missing wheels and/or the sdist) even on a green run. This is the upload-artifact v3→v4 breaking-change trap.

Root cause

#649 (af0ed799, Nov 2024) bumped upload-artifact/download-artifact from v3 → v4 but kept the v3-era pattern:

• All three build_wheels matrix legs (ubuntu-20.04, macos-13, macos-14) uploaded under the same name wheel-artifacts.
• publish downloaded the sdist by name into dist/, then downloaded wheels with pattern: "*artifact*" and no path: (so they land in the workspace root, not dist/ — and gh-action-pypi-publish publishes from dist/).

Under v3, multiple uploads to the same name were merged, so this worked. Under v4 that implicit merge is gone: each upload is its own immutable artifact and re-uploading the same name fails. So the matrix legs collide on wheel-artifacts, and the wheel download misses dist/.

Why it hasn't broken a release yet

The most recent release, v0.11.3 (Aug 2024), predates #649 and still used upload-artifact@v3, so it shipped a complete set (sdist + macOS/manylinux wheels — verified on PyPI). The bug is latent: the next release (first one after #649) is where it bites.

The fix (canonical cibuildwheel-on-v4 pattern)

• Unique artifact names per uploader: cibw-wheels-${{ matrix.os }} and cibw-sdist.
• Single collection in publish: download-artifact@v4 with pattern: cibw-*, merge-multiple: true, path: dist.
• skip-existing: true on the publish step so a re-run can backfill missing files idempotently.
• if-no-files-found: error on the uploads so an empty build fails loudly instead of silently publishing nothing.

Notes / follow-ups

• Release jobs only run on release: created, so this can't be exercised by PR CI — it's validated by inspection + valid-YAML check. Consider adding a workflow_dispatch trigger (gated alongside the release condition) so a fixed release can be re-published on demand, and a post-publish check asserting the index has both an sdist and the expected wheels.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.10%. Comparing base (a413a74) to head (0d3e304).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #684   +/-   ##
=======================================
  Coverage   94.10%   94.10%           
=======================================
  Files         102      102           
  Lines       11107    11107           
  Branches     1198     1198           
=======================================
  Hits        10452    10452           
  Misses        556      556           
  Partials       99       99           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.