From 28debba035057aa49a8f0fdf7120b6e34bfd86a2 Mon Sep 17 00:00:00 2001 From: Jack Harper Date: Mon, 30 Jun 2025 11:40:35 +0100 Subject: [PATCH 1/5] use reusable workflows --- .github/workflows/python-publish.yml | 146 +++++++++++++++------------ .github/workflows/python.yml | 16 ++- 2 files changed, 89 insertions(+), 73 deletions(-) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index 78c2089..fa5bbb2 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -1,72 +1,92 @@ -# This workflow will upload a Python Package to PyPI when a release is created -# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries - -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Upload Python Package - -on: - release: - types: [published] - -permissions: - contents: read - +name: Publish Python distribution to PyPI +on: push jobs: - release-build: + lint-and-test: + if: github.ref_type == 'tag' + name: Run linter and tests + uses: ./.github/workflows/Lint-and-test.yml + build: + needs: lint-and-test + if: github.ref_type == 'tag' + name: build distribution runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - uses: actions/setup-python@v5 - with: - python-version: "3.x" - - - name: Build release distributions - run: | - # NOTE: put your own distribution build steps here. - python -m pip install build - python -m build - - - name: Upload distributions - uses: actions/upload-artifact@v4 - with: - name: release-dists - path: dist/ - - pypi-publish: + - uses: actions/checkout@v4 + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: "3.11" + - name: Install pypa/build + run: >- + python3 -m + pip install + build + --user + - name: Build a binary wheel and a source tarball + run: python3 -m build + - name: Store the distribution packages + uses: actions/upload-artifact@v4 + with: + name: python-package-distributions + path: dist/ + publish-to-pypi: + name: >- + Publish Python distribution to PyPI + if: github.ref_type == 'tag' + needs: [lint-and-test, build] runs-on: ubuntu-latest - needs: - - release-build + environment: + name: release + url: https://pypi.org/p/lewis permissions: - # IMPORTANT: this permission is mandatory for trusted publishing - id-token: write + id-token: write # IMPORTANT: mandatory for trusted publishing + steps: + - name: Download all the dists + uses: actions/download-artifact@v4 + with: + name: python-package-distributions + path: dist/ + - name: Publish distribution to PyPI + uses: pypa/gh-action-pypi-publish@release/v1 + github-release: + name: >- + Sign the Python distribution with Sigstore + and upload them to GitHub Release + needs: [lint-and-test, build, publish-to-pypi] + runs-on: ubuntu-latest - # Dedicated environments with protections for publishing are strongly recommended. - # For more information, see: https://docs.github.com/en/actions/deployment/targeting-different-environments/using-environments-for-deployment#deployment-protection-rules - environment: - name: pypi - # OPTIONAL: uncomment and update to include your PyPI project URL in the deployment status: - # url: https://pypi.org/p/YOURPROJECT - # - # ALTERNATIVE: if your GitHub Release name is the PyPI project version string - # ALTERNATIVE: exactly, uncomment the following line instead: - # url: https://pypi.org/project/YOURPROJECT/${{ github.event.release.name }} + permissions: + contents: write # IMPORTANT: mandatory for making GitHub Releases + id-token: write # IMPORTANT: mandatory for sigstore steps: - - name: Retrieve release distributions - uses: actions/download-artifact@v4 - with: - name: release-dists - path: dist/ - - - name: Publish release distributions to PyPI - uses: pypa/gh-action-pypi-publish@release/v1 - with: - packages-dir: dist/ + - name: Download all the dists + uses: actions/download-artifact@v4 + with: + name: python-package-distributions + path: dist/ + - name: Sign the dists with Sigstore + uses: sigstore/gh-action-sigstore-python@v3.0.0 + with: + inputs: >- + ./dist/*.tar.gz + ./dist/*.whl + - name: Create GitHub Release + env: + GITHUB_TOKEN: ${{ github.token }} + run: >- + gh release create + '${{ github.ref_name }}' + --repo '${{ github.repository }}' + --notes "" + - name: Upload artifact signatures to GitHub Release + env: + GITHUB_TOKEN: ${{ github.token }} + # Upload to GitHub Release using the `gh` CLI. + # `dist/` contains the built packages, and the + # sigstore-produced signatures and certificates. + run: >- + gh release upload + '${{ github.ref_name }}' dist/** + --repo '${{ github.repository }}' diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml index b0d4798..20668fa 100644 --- a/.github/workflows/python.yml +++ b/.github/workflows/python.yml @@ -13,10 +13,13 @@ permissions: contents: read jobs: - build: - + call-workflow: + uses: ISISComputingGroup/reusable-workflows/.github/workflows/linters.yml@main + with: + compare-branch: origin/main + python-ver: '3.12' + tests: runs-on: ubuntu-latest - steps: - uses: actions/checkout@v4 - name: Install uv and set the python version @@ -25,12 +28,5 @@ jobs: python-version: "3.12" - name: Install dependencies run: uv sync --all-extras --dev - - name: ruff format check - run: uv run ruff format --check - - name: ruff check - run: uv run ruff check - - name: pyright - run: uv run pyright - name: Test with pytest run: uv run pytest tests - From 242d9743485ea0c4f9426f1e99ac834b872819bf Mon Sep 17 00:00:00 2001 From: Jack Harper Date: Mon, 30 Jun 2025 11:44:42 +0100 Subject: [PATCH 2/5] Trigger Build From 1ba9ef78e9a25314f0c9008388927975a290dfbc Mon Sep 17 00:00:00 2001 From: Jack Harper Date: Mon, 30 Jun 2025 11:45:48 +0100 Subject: [PATCH 3/5] rename python.yml to Lint-and-test.yml --- .github/workflows/{python.yml => Lint-and-test.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{python.yml => Lint-and-test.yml} (100%) diff --git a/.github/workflows/python.yml b/.github/workflows/Lint-and-test.yml similarity index 100% rename from .github/workflows/python.yml rename to .github/workflows/Lint-and-test.yml From 621b6470b0b83d27fb47ab262b239b54d1ecf681 Mon Sep 17 00:00:00 2001 From: Jack Harper Date: Mon, 30 Jun 2025 11:53:01 +0100 Subject: [PATCH 4/5] Potential fix for code scanning alert no. 1: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .github/workflows/python-publish.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml index fa5bbb2..7ab2907 100644 --- a/.github/workflows/python-publish.yml +++ b/.github/workflows/python-publish.yml @@ -3,6 +3,8 @@ on: push jobs: lint-and-test: if: github.ref_type == 'tag' + permissions: + contents: read name: Run linter and tests uses: ./.github/workflows/Lint-and-test.yml build: From 7b5927852d6b047b23dc0e51f6081ea301124930 Mon Sep 17 00:00:00 2001 From: Jack Harper Date: Mon, 30 Jun 2025 11:54:18 +0100 Subject: [PATCH 5/5] test --- .github/workflows/Lint-and-test.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/Lint-and-test.yml b/.github/workflows/Lint-and-test.yml index 20668fa..e21d711 100644 --- a/.github/workflows/Lint-and-test.yml +++ b/.github/workflows/Lint-and-test.yml @@ -10,7 +10,9 @@ on: branches: [ "main" ] permissions: + actions: read contents: read + security-events: write jobs: call-workflow: