[yaythomas]

Issue #, if available

None. This change follows up on Python SDK PR #789: document protected PyPI publishing.

Description of changes

The note in How Publishing Works said PyPI rejects an already published filename. PyPI accepts a re-upload whose files match the published ones. It rejects the upload only when the files differ, for example after a README change without a version bump. That package's job then fails, and GitHub skips the emulator image job. The note now describes both cases, and the checklist names the check for a testing-v release.

The change also shortens RELEASING.md from 337 to 262 lines:

• The protection rules appeared in four places. Release Permissions and Protection now states them, and other sections link to it.
• Publishing a Package for the First Time now keeps the steps specific to this repository: the files to update, the PyPI account, and the trusted publisher values. It links PyPI's guide for the rest. The removed text explained general PyPI and GitHub behavior. It also described a workflow change that the repository does not have.

Design

See Rules for every change.

• Design note (rule 3): not needed. The change edits documentation only.
• Simpler options considered (rule 2): the change adds no logic.
• Root cause (rule 5): not applicable. The change fixes documentation, not code.
• Net change in source lines and in public API members: none. RELEASING.md has 70 lines added and 145 removed.

Assumptions

• PyPI accepts a re-upload of identical files, and rejects changed files with 400 File already exists. GitHub then skips publish-emulator-image. Evidence: the telemetry-exporter-v1.0.0 release run. The SDK had not changed since 3.0.0, and its re-upload of 3.0.0 succeeded. Python SDK PR #847: remove obsolete OTel layer publishing changed the OTel README after 2.0.0, and PyPI rejected the re-upload of OTel 2.0.0.
• The pypi environment accepts only runs on a tag that matches the four patterns. Evidence: the environment's deployment policies, and GitHub's documentation on deployment branches and tags.
• The table's trusted publisher values match the existing projects. Evidence: the PyPI provenance for the current release of each of the four projects records these values.
• durable-execution-dev owns the four existing projects. Evidence: the ownership field in each project's PyPI JSON response.
• The account that adds a pending publisher becomes the new project's owner. Evidence: warehouse/oidc/views.py creates the project with the pending publisher's added_by user as its owner.
• A publisher without an environment accepts an upload from a run of the workflow on any branch. Evidence: warehouse/oidc/models/github.py skips the environment check when the publisher has no environment, and compares the workflow path against the run's own ref.

Decisions not covered by the issue or the design note

• The text names the durable-execution-dev account, because PyPI already lists it publicly as the owner of all four projects.
• The first-time steps link to Tagging Convention for a new prefix. That section already says to configure the prefix in both protection rules, so the steps do not repeat it.
• The ci.yml legal-files step still omits the telemetry exporter. Adding it changes a workflow, so it belongs in a separate PR.

Checklist

The change edits documentation only, so the test items do not apply.

• Every new branch has a test that fails without it (rule 4)
• For a bug fix: the first commit adds a test that fails on the current code (rule 5)
• Every edited test expectation is listed in the description, with the reason (rule 5)

Testing: I rendered RELEASING.md with GitHub's Markdown API. Every in-page link resolves to a heading, every relative link resolves to a file, and the table renders inside its list step. git diff --check and the repository's commit-message lint pass.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[github-actions]

Codex AI review

No actionable findings after reviewing the complete diff against rules 1–9 and the checked-in release workflows. Documentation-only change; no tests were run, and the cited external PyPI/GitHub evidence was not independently verified.

Reviewed commit 31dd42bb0d5e4bf6366056fd3bcf3dea4fcc9e09. Workflow run