Skip to content

Merge pull request #1097 from atsign-foundation/dependabot/pip/packag… #240

Merge pull request #1097 from atsign-foundation/dependabot/pip/packag…

Merge pull request #1097 from atsign-foundation/dependabot/pip/packag… #240

name: Build and publish sshnpd PyPI package
on:
workflow_dispatch:
push:
tags:
- 'p*.*.*'
branches:
- trunk
paths:
- 'packages/python/sshnpd/**'
permissions: # added using https://github.com/step-security/secure-repo
contents: read
jobs:
build:
name: Build package
runs-on: ubuntu-latest
steps:
- name: Checkout this repo
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
- name: Set up Python
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
with:
python-version: '3.11'
- name: Install Poetry
uses: abatilo/actions-poetry@7b6d33e44b4f08d7021a1dee3c044e9c253d6439 # v3.0.0
with:
poetry-version: '1.8.3'
# The dark mode and light mode Atsign logos in the GitHub README don't
# show properly on PyPI so we have a copy of the README.md in
# README.PyPI.md with just the light mode logo.
# That README is generated here from a stub header line plus the rest
# of the main README.md
- name: Generate README for PyPI
working-directory: packages/python/sshnpd
run: |
mv README.PyPI.md.stub README.PyPI.md
tail -n +2 README.md >> README.PyPI.md
- name: Build using Poetry
working-directory: packages/python/sshnpd
run: |
poetry build
cp -r dist/ $GITHUB_WORKSPACE
- name: Store the distribution packages
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
with:
name: sshnpd-python-package
path: dist/
publish-to-testpypi:
name: Publish package to TestPyPI
needs:
- build
runs-on: ubuntu-latest
environment:
name: testpypi
url: https://test.pypi.org/p/sshnpd
permissions:
id-token: write # IMPORTANT: mandatory for trusted publishing
steps:
- name: Download all the dists
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
with:
name: sshnpd-python-package
path: dist/
- name: Publish distribution to TestPyPI
uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450 # v1.8.14
with:
skip-existing: true
repository-url: https://test.pypi.org/legacy/
publish-to-pypi:
name: Publish package to PyPI
if: startsWith(github.ref, 'refs/tags/p') # only publish to PyPI on tag pushes
needs:
- build
runs-on: ubuntu-latest
environment:
name: pypi
url: https://pypi.org/p/sshnpd
permissions:
id-token: write # IMPORTANT: mandatory for trusted publishing
steps:
- name: Download all the dists
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
with:
name: sshnpd-python-package
path: dist/
- name: Publish distribution to PyPI
uses: pypa/gh-action-pypi-publish@81e9d935c883d0b210363ab89cf05f3894778450 # v1.8.14
github-release:
name: Attest Python distribution artifacts and upload them to the GitHub Release
needs:
- publish-to-pypi
runs-on: ubuntu-latest
outputs:
hashes: ${{ steps.hash.outputs.hashes }}
permissions:
contents: write # IMPORTANT: mandatory for making GitHub Releases
id-token: write # IMPORTANT: mandatory for sigstore
attestations: write
steps:
- name: Checkout requirements.txt
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
with:
sparse-checkout: packages/python/sshnpd/requirements.txt
sparse-checkout-cone-mode: false
- name: Download all the dists
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
with:
name: sshnpd-python-package
path: dist/
- name: Install Syft
uses: anchore/sbom-action/download-syft@e8d2a6937ecead383dfe75190d104edd1f9c5751 # v0.16.0
- name: Generate SBOMs
run: |
syft scan file:./packages/python/sshnpd/requirements.txt \
-o 'spdx-json=dist/python_sshnpd_sbom.spdx.json' \
-o 'cyclonedx-json=dist/python_sshnpd_sbom.cyclonedx.json'
- name: Generate SHA256 checksums
working-directory: dist
run: sha256sum * > checksums.txt
- id: hash
name: Pass artifact hashes for SLSA provenance
working-directory: dist
run: |
echo "hashes=$(cat checksums.txt | base64 -w0)" >> "$GITHUB_OUTPUT"
- name: Attest the release artifacts
uses: actions/attest-build-provenance@49df96e17e918a15956db358890b08e61c704919 # v1.2.0
with:
subject-path: 'dist/**'
- name: Upload artifact signatures to GitHub Release
env:
GITHUB_TOKEN: ${{ github.token }}
# Upload to GitHub Release using the `gh` CLI.
# `dist/` contains the built packages
run: >-
gh release upload
'${{ github.ref_name }}' dist/**
--repo '${{ github.repository }}'
provenance:
needs: [github-release]
permissions:
actions: read # Needed for detection of GitHub Actions environment.
id-token: write # Needed for provenance signing and ID
contents: write # Needed for release uploads
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] # 5a775b367a56d5bd118a224a811bba288150a563
with:
base64-subjects: "${{ needs.github-release.outputs.hashes }}"
upload-assets: true