blob: 77524b95cdf0f92cb118e18388d8b98c4eaae93d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
name: Publish to PyPI
on:
workflow_dispatch:
inputs:
run_id:
description: The run of wheel-builder to use for finding artifacts.
required: true
environment:
description: Which PyPI environment to upload to
required: true
type: choice
options: ["testpypi", "pypi"]
workflow_run:
workflows: ["Wheel Builder"]
types: [completed]
env:
PUBLISH_REQUIREMENTS_PATH: .github/requirements/publish-requirements.txt
permissions:
contents: read
jobs:
publish:
runs-on: ubuntu-latest
# We're not actually verifying that the triggering push event was for a
# tag, because github doesn't expose enough information to do so.
# wheel-builder.yml currently only has push events for tags.
if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.event == 'push' && github.event.workflow_run.conclusion == 'success')
permissions:
id-token: "write"
attestations: "write"
steps:
- run: echo "$EVENT_CONTEXT"
env:
EVENT_CONTEXT: ${{ toJson(github.event) }}
- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
with:
python-version: "3.11"
- name: Get publish-requirements.txt from repository
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
with:
sparse-checkout: |
${{ env.PUBLISH_REQUIREMENTS_PATH }}
sparse-checkout-cone-mode: false
persist-credentials: false
- name: Install Python dependencies
run: pip install --require-hashes -r ${{ env.PUBLISH_REQUIREMENTS_PATH }}
- uses: dawidd6/action-download-artifact@09f2f74827fd3a8607589e5ad7f9398816f540fe # v3.1.4
with:
path: dist/
run_id: ${{ github.event.inputs.run_id || github.event.workflow_run.id }}
- run: |
echo "OIDC_AUDIENCE=pypi" >> $GITHUB_ENV
echo "PYPI_DOMAIN=pypi.org" >> $GITHUB_ENV
echo "TWINE_REPOSITORY=pypi" >> $GITHUB_ENV
echo "TWINE_USERNAME=__token__" >> $GITHUB_ENV
if: github.event_name == 'workflow_run' || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'pypi')
- run: |
echo "OIDC_AUDIENCE=testpypi" >> $GITHUB_ENV
echo "PYPI_DOMAIN=test.pypi.org" >> $GITHUB_ENV
echo "TWINE_REPOSITORY=testpypi" >> $GITHUB_ENV
echo "TWINE_USERNAME=__token__" >> $GITHUB_ENV
if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'testpypi'
- run: |
import os
import requests
response = requests.get(
os.environ["ACTIONS_ID_TOKEN_REQUEST_URL"],
params={"audience": os.environ["OIDC_AUDIENCE"]},
headers={"Authorization": f"bearer {os.environ['ACTIONS_ID_TOKEN_REQUEST_TOKEN']}"}
)
response.raise_for_status()
token = response.json()["value"]
response = requests.post(f"https://{os.environ['PYPI_DOMAIN']}/_/oidc/mint-token", json={"token": token})
response.raise_for_status()
pypi_token = response.json()["token"]
with open(os.environ["GITHUB_ENV"], "a") as f:
print(f"::add-mask::{pypi_token}")
f.write(f"TWINE_PASSWORD={pypi_token}\n")
shell: python
- run: twine upload --skip-existing $(find dist/ -type f -name 'cryptography*')
# Do not perform attestation for things for TestPyPI. This is because
# there's nothing that would prevent a malicious PyPI from serving a
# signed TestPyPI asset in place of a release intended for PyPI.
- uses: actions/attest-build-provenance@173725a1209d09b31f9d30a3890cf2757ebbff0d # v1.1.2
with:
subject-path: 'dist/**/cryptography*'
if: env.TWINE_REPOSITORY == 'pypi'
|
