The workflow was run with the 'attestations: true' input, but an explicit password was also set, disabling Trusted Publishing. As a result, the attestations input is ignored.

Trusted Publishers allows publishing packages to PyPI from automated environments like GitHub Actions without needing to use username/password combinations or API tokens to authenticate with PyPI. Read more: https://docs.pypi.org/trusted-publishers

A new Trusted Publisher for the currently running publishing workflow can be created by accessing the following link(s) while logged-in as an owner of the package(s):

Failed to save: Unable to reserve cache with key setup-pdm-Linux-X64-python-3.13.3-6e8d08be8b1f7d6bfea5bfae2cd18df281aa342561feb951ab798c336cda77de, another job may be creating this cache. More details: This legacy service is shutting down, effective April 15, 2025. Migrate to the new service ASAP. For more information: https://gh.io/gha-cache-sunset

Failed to restore: Cache service responded with 422

"pull_request_target.opened" is not a known webhook name (https://developer.github.com/v3/activity/events/types/)

"pull_request_target.reopened" is not a known webhook name (https://developer.github.com/v3/activity/events/types/)

"pull_request_target.synchronize" is not a known webhook name (https://developer.github.com/v3/activity/events/types/)