what is gh-action-adapt-sigstore-pypi fr?

When you publish a Python package to PyPI, you may want to prove to users exactly how it was built, what source code it came from, what build system was used, and so on. GitHub offers a tool that generates this kind of "proof" in a format called a Sigstore bundle. The problem is that PyPI expects this proof in a slightly different format, called a PyPI attestation. This action bridges that gap by converting GitHub's Sigstore bundles into the format PyPI can actually understand and display. In practice, you use it as a step in your GitHub Actions release workflow. First, another GitHub action generates the Sigstore bundles that describe your build. Then this action takes those bundles as input, translates them, and writes out converted attestation files to a directory you specify (or a temporary one if you don't). From there, you can upload those attestations alongside your package when publishing to PyPI. This is most useful for Python package maintainers who want to give their users strong, verifiable assurance that the package on PyPI was built from the expected source, not tampered with or replaced. For example, a library author releasing a new version to PyPI could use this so that anyone who installs the package can cryptographically verify it was built from the correct GitHub commit. It's particularly relevant for security-conscious projects or those following supply-chain hardening practices. The tool is narrowly scoped, it does one conversion step and nothing else. The README doesn't go into detail about the underlying differences between the two formats or what happens to fields that don't map cleanly between them. It's a small, focused utility designed to slot into an existing publishing pipeline rather than stand on its own.