reverse_argparse/.github/workflows/semantic-release.yml at master · sandialabs/reverse_argparse · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
name: Semantic Release

on:
  push:
    branches:
      - master

permissions:
  contents: read

concurrency:
  group: release

jobs:
  release:
    runs-on: ubuntu-latest
    environment: release
    permissions:
      id-token: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ secrets.GH_TOKEN }}

      - name: Python Semantic Release
        id: release
        uses: python-semantic-release/python-semantic-release@b700dbeb1f431a0fcc30a79f3f0869407fe07278 # v10.7.0
        with:
          git_committer_email: "reverse-argparse-semantic-release@sandia.gov"
          git_committer_name: "semantic-release"
          github_token: ${{ secrets.GH_TOKEN }}
          ssh_private_signing_key: ${{ secrets.SEMANTIC_RELEASE_PRIVATE_KEY }}
          ssh_public_signing_key: ${{ secrets.SEMANTIC_RELEASE_PUBLIC_KEY }}

      - name: Hash Build Artifacts
        if: steps.release.outputs.released == 'true'
        id: hash
        run: |
          cd dist
          echo "hashes=$(find . -type f -exec sha256sum {} + | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT"

      - name: Upload Build Artifacts
        if: steps.release.outputs.released == 'true'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: dist
          path: dist/

    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
      released: ${{ steps.release.outputs.released }}

  provenance:
    needs: release
    if: ${{ needs.release.outputs.released == 'true' }}
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: "${{ needs.release.outputs.hashes }}"

  publish:
    runs-on: ubuntu-latest
    needs: [release, provenance]
    if: ${{ needs.release.outputs.released == 'true' && needs.provenance.outputs.outcome == 'success' }}
    environment: release
    permissions:
      id-token: write

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          token: ${{ secrets.GH_TOKEN }}

      - name: Download Build Artifacts
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: dist
          path: dist

      - name: Download Provenance
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: ${{ needs.provenance.outputs.provenance-name }}
          path: dist

      - name: Publish to GitHub Releases
        uses: python-semantic-release/publish-action@99d4062dd393b5a7a62c5fe9ed78fb364b5674f2 # v10.7.0
        with:
          github_token: ${{ secrets.GH_TOKEN }}

      - name: Remove Provenance for PyPI Upload
        run: rm -f dist/${{ needs.provenance.outputs.provenance-name }}

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1