build(deps): bump actions/attest-build-provenance from 1.4.4 to 2.0.1 in the actions group #737
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: publish distributions | |
| on: | |
| push: | |
| branches: | |
| - main | |
| tags: | |
| - v* | |
| pull_request: | |
| branches: | |
| - main | |
| - release/v* | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| publish: | |
| type: choice | |
| description: 'Publish to TestPyPI?' | |
| options: | |
| - false | |
| - true | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: Build Python distribution | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.x' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install uv | |
| - name: Build a sdist and a wheel | |
| run: | | |
| pipx run build --installer uv . | |
| - name: Verify history available for dev versions | |
| run: | | |
| wheel_name=$(find dist/ -iname "*.whl" -printf "%f\n") | |
| if [[ "${wheel_name}" == *"pylhe-0.1.dev"* ]]; then | |
| echo "python-build incorrectly named built distribution: ${wheel_name}" | |
| echo "python-build is lacking the history and tags required to determine version number" | |
| echo "intentionally erroring with 'return 1' now" | |
| return 1 | |
| fi | |
| echo "python-build named built distribution: ${wheel_name}" | |
| - name: Verify the distribution | |
| run: pipx run twine check --strict dist/* | |
| - name: List contents of sdist | |
| run: python -m tarfile --list dist/pylhe-*.tar.gz | |
| - name: List contents of wheel | |
| run: python -m zipfile --list dist/pylhe-*.whl | |
| - name: Generate artifact attestation for sdist and wheel | |
| # If publishing to TestPyPI or PyPI | |
| if: >- | |
| (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe') | |
| || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe') | |
| || (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe') | |
| uses: actions/attest-build-provenance@c4fbc648846ca6f503a13a2281a5e7b98aa57202 # v2.0.1 | |
| with: | |
| subject-path: "dist/pylhe-*" | |
| - name: Upload distribution artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dist-artifact | |
| path: dist | |
| publish: | |
| name: Publish Python distribution to (Test)PyPI | |
| if: github.event_name != 'pull_request' | |
| needs: build | |
| runs-on: ubuntu-latest | |
| # Mandatory for publishing with a trusted publisher | |
| # c.f. https://docs.pypi.org/trusted-publishers/using-a-publisher/ | |
| permissions: | |
| id-token: write | |
| # Restrict to the environment set for the trusted publisher | |
| environment: | |
| name: publish-package | |
| steps: | |
| - name: Download distribution artifact | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: dist-artifact | |
| path: dist | |
| - name: List all files | |
| run: ls -lh dist | |
| - name: Verify sdist artifact attestation | |
| # If publishing to TestPyPI or PyPI | |
| if: >- | |
| (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe') | |
| || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe') | |
| || (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe') | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh attestation verify dist/pylhe-*.tar.gz --repo ${{ github.repository }} | |
| - name: Verify wheel artifact attestation | |
| # If publishing to TestPyPI or PyPI | |
| if: >- | |
| (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe') | |
| || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe') | |
| || (github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe') | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh attestation verify dist/pylhe-*.whl --repo ${{ github.repository }} | |
| - name: Publish distribution 📦 to Test PyPI | |
| # Publish to TestPyPI on tag events of if manually triggered | |
| # Compare to 'true' string as booleans get turned into strings in the console | |
| if: >- | |
| (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && github.repository == 'scikit-hep/pylhe') | |
| || (github.event_name == 'workflow_dispatch' && github.event.inputs.publish == 'true' && github.repository == 'scikit-hep/pylhe') | |
| uses: pypa/[email protected] | |
| with: | |
| repository-url: https://test.pypi.org/legacy/ | |
| print-hash: true | |
| attestations: true | |
| - name: Publish distribution 📦 to PyPI | |
| if: github.event_name == 'release' && github.event.action == 'published' && github.repository == 'scikit-hep/pylhe' | |
| uses: pypa/[email protected] | |
| with: | |
| print-hash: true | |
| attestations: true |