From dc71b3fe3cf78ac7101725fe5cf88ee4b4e3428a Mon Sep 17 00:00:00 2001
From: Imani Manyara <19682005+imanimanyara@users.noreply.github.com>
Date: Tue, 6 Oct 2026 07:24:41 -0400
Subject: [PATCH 1/3] Pause PyPI publishing until PUBLISH_PYPI is set

The owner has paused all PyPI publishing until further notice. Each job
that uploads to PyPI now runs only when the repository or org variable
PUBLISH_PYPI is 'true'; tags still build and publish the GitHub release.
---
 .github/workflows/release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 529b9cb..5038aef 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,6 +10,9 @@ permissions:
 
 jobs:
   publish:
+    # PyPI publishing is paused until the owner sets the repository (or org)
+    # variable PUBLISH_PYPI to 'true'. Tags still build and release on GitHub.
+    if: ${{ vars.PUBLISH_PYPI == 'true' }}
     name: build + publish wheel + bundle
     runs-on: ubuntu-latest
     environment:

From e3046fd526d45346ec4ab51b57426f69485655fb Mon Sep 17 00:00:00 2001
From: Imani Manyara <19682005+imanimanyara@users.noreply.github.com>
Date: Tue, 6 Oct 2026 07:26:02 -0400
Subject: [PATCH 2/3] Gate only the PyPI upload step, not the whole job

The publish job also bundles the installer and creates the GitHub release.
A job-level condition would have skipped those on every tag; only the
PyPI upload waits for PUBLISH_PYPI now.
---
 .github/workflows/release.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5038aef..529b9cb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,9 +10,6 @@ permissions:
 
 jobs:
   publish:
-    # PyPI publishing is paused until the owner sets the repository (or org)
-    # variable PUBLISH_PYPI to 'true'. Tags still build and release on GitHub.
-    if: ${{ vars.PUBLISH_PYPI == 'true' }}
     name: build + publish wheel + bundle
     runs-on: ubuntu-latest
     environment:

From 4e160672b5ed112feba75879ac2a46fa7e4bd5f8 Mon Sep 17 00:00:00 2001
From: Imani Manyara <19682005+imanimanyara@users.noreply.github.com>
Date: Tue, 6 Oct 2026 07:26:19 -0400
Subject: [PATCH 3/3] Gate the PyPI upload step itself

The previous commit removed the job-level condition but did not add the
step-level one (the step names itself before uses:), leaving PyPI
publishing ungated. The upload step now carries the condition.
---
 .github/workflows/release.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 529b9cb..a5d9380 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,7 +34,10 @@ jobs:
           # chokes on non-wheel/sdist entries.
           rm -rf dist/__pycache__
 
+      # PyPI publishing is paused until the repository or org variable PUBLISH_PYPI
+      # is 'true'. Bundling and the GitHub release below still run on every tag.
       - name: Upload to PyPI (only whl + sdist)
+        if: ${{ vars.PUBLISH_PYPI == 'true' }}
         uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         # At this point dist/ contains exactly *.whl + *.tar.gz. The
         # bundle + checksum file are written to bundle/ in the next