ci(maint/0.14): upload to PyPI from the runner instead of docker compose

[dimitri-yatsenko]

The v0.14.10 release job built the package but failed before uploading: the upload ran through docker compose run app, which waits for the minio service, and the minio/minio image is no longer available on Docker Hub. Nothing reached PyPI.

This copies master's upload step to maint/0.14: twine runs directly on the runner, using the same secrets. It also opens the automatic version.py PR against maint/0.14 instead of master.

After merging, the v0.14.10 release and tag need to be re-created on the new commit, because a release runs the workflow file from its tagged commit. The package contents are unchanged.

[MilagrosMarin]

Checked the two things that would actually break this rather than the description.

Credentials survive the restructure. The job-level env: block supplies TWINE_USERNAME/TWINE_PASSWORD, so dropping the inline exports from the else-branch leaves the production path intact — only the ^Test branch needs its overrides.

dist/ is on the runner. python -m build . runs directly after setup-python; only the upload was ever containerized. So twine upload dist/* sees what the build step produced.

The Publish step is byte-identical to master's, comment included, and it has been running there since 980214a (2026-07-21).

The tagged-commit reasoning checks out empirically, which is the part I wanted to confirm: master had this exact fix 2.5 months before the v0.14.10 release, and that release still failed on minio. That only happens if the release ran maint/0.14's own workflow file — so yes, it has to land here, and the tag has to be re-cut.

Also confirmed the release path is fully unblocked and not just half: the sibling call-publish-docs job builds from docs/docker-compose.yaml, which has no minio service.

One nit. NEW_VERSION at line 78 is now dead — the only thing that read it was the "$NEW_VERSION" != "$LATEST_PYPI" comparison this removes. Master doesn't set it at all. One line to drop.

Out of scope, but worth knowing before re-cutting. No Test run shows up on maint/0.14 — only Lint, back to February, and none on this PR. test.yaml's paths: filters are datajoint and tests without /**, so they match only files with exactly those names. Whatever ships as 0.14.10 is going out on lint alone. Separately, this branch's docker-compose.yaml still pulls minio/minio from Docker Hub; #1559 fixed that on master in tests/conftest.py, which this branch's compose-based test path doesn't use.

[dimitri-yatsenko]

Thanks @MilagrosMarin. Your checks matched mine. 0.14.10 is now on PyPI: after merging this, I re-created the v0.14.10 tag on the new commit, and the upload went through on the second attempt (the first was cancelled during GitHub's Actions incident).

We're leaving the unused NEW_VERSION line and the test.yaml path filters as they are, since pre-2.0 is no longer supported and we're keeping CI work on maint/0.14 to a minimum. The release notes say the full test suite was not run.