gistfile1.txt

● Now the picture is complete and it's a single shared point of failure:

  - All 6 repos clean the PyPI dir with the same reusable action, check-release-fileset@main (keep-metadata: false).
  - 5 of 6 (txaio, zlmdb, cfxdb, wamp-xbr, crossbar) then publish the whole cleaned dir via OIDC packages-dir: dist/ — so they
  all depend on that action producing a truly clean dir.
  - Only autobahn is independently safe, because it uses twine upload dist/*.whl dist/*.tar.gz (explicit globs).
  - The action's keep-metadata: false uses a denylist that misses build-info.txt. crossbar/cfxdb/wamp-xbr haven't hit it only
  because their builds don't emit that file; zlmdb does.

  So the coherent, reusable fix is one change in wamp-cicd: make check-release-fileset (keep-metadata: false) leave only *.whl
  + *.tar.gz (allowlist, honoring its own stated purpose) — which fixes all 6 at once and unblocks zlmdb without any per-repo
  staging step. wamp-cicd is a working repo here. Let me record all this in the epic.