Merge pull request #8 from lsst-sqre/tickets/DM-47489/pin-gh-action-pypi-publish

DM-47489: Pin `gh-action-pypi-publish` to v1.11.0

Author: fajpunk

action.yaml

@@ -48,6 +48,8 @@ runs:
 
     - name: Publish
       if: fromJSON(inputs.upload) == true
-      uses: pypa/gh-action-pypi-publish@release/v1
+      # Pinned because 1.12 breaks using this in a composite action:
+      # https://github.com/pypa/gh-action-pypi-publish/issues/299
+      uses: pypa/[email protected]
       with:
         packages-dir: ${{ inputs.working-directory }}/dist