pypa/cibuildwheel adds commit to wheel names

We have a great Github action that uses pypa/cibuildwheel to build binary wheels for multiple platforms, but it is generating local filenames that PyPI won't accept. For example:

pyodbc-4.0.33+commitf28d235-cp39-cp39-win_amd64.whl

Example run: https://github.com/mkleehammer/pyodbc/runs/7344392464?check_suite_focus=true

See https://github.com/pypa/pypi-legacy/issues/731

The +commit is intended to mark a local-only build that should not be shared.

Does anyone know why or how to fix?

I first thought it was built before the tag was pushed so I reran the action to rebuild the artifacts, but that did not work. Debug logging shows it is checking out the tag instead of just the branch. That seems like it could be it, but it seems like lots of projects would be hitting the error and I don't see any.

 Checking out the ref
 /usr/bin/git checkout --progress --force refs/tags/4.0.33
 Note: switching to 'refs/tags/4.0.33'.

 You are in 'detached HEAD' state. You can look around, make experimental
 changes and commit them, and you can discard any commits you make in this
 state without impacting any branches by switching back to a branch.

 If you want to create a new branch to retain commits you create, you may
 do so (now or later) by using -c with the switch command. Example:

   git switch -c <new-branch-name>

 Or undo this operation with:

   git switch -

 Turn off this advice by setting config variable advice.detachedHead to false

 HEAD is now at f28d235 Note EOL of 2.7 support in README (#945)

I don't see red flags in the building of the wheel and the filename is what is generated by cibuildwheel, not something auditwheel is doing.

mkleehammer / pyodbc

pypa/cibuildwheel adds commit to wheel names #1078