Skip to content

Commit c4e8c9d

Browse files
hickeymahickeyma
committed
Restructure GitHub workflows
- Add security on the workflows and runners - Add checking on the workflows - Add workflow to build pypi package Signed-off-by: Martin Hickey <[email protected]>
1 parent fb29817 commit c4e8c9d

File tree

10 files changed

+401
-78
lines changed

10 files changed

+401
-78
lines changed

‎.github/workflows/actionlint.dockerfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Since dependabot cannot update workflows using docker,
2+
# we use this indirection since dependabot can update this file.
3+
FROM rhysd/actionlint:1.7.4@sha256:82244e1db1c60d82c7792180a48dd0bcb838370bb589d53ff132503fc9485868

‎.github/workflows/actionlint.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Lint GitHub Actions workflows
2+
on:
3+
push:
4+
branches:
5+
- "main"
6+
- "release-**"
7+
paths:
8+
- '.github/workflows/*.ya?ml'
9+
- '.github/workflows/actionlint.*' # This workflow
10+
pull_request:
11+
branches:
12+
- "main"
13+
- "release-**"
14+
paths:
15+
- '.github/workflows/*.ya?ml'
16+
- '.github/workflows/actionlint.*' # This workflow
17+
18+
env:
19+
LC_ALL: en_US.UTF-8
20+
21+
defaults:
22+
run:
23+
shell: bash
24+
25+
permissions:
26+
contents: read
27+
28+
jobs:
29+
actionlint:
30+
runs-on: ubuntu-latest
31+
steps:
32+
- name: "Harden Runner"
33+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
34+
with:
35+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
36+
37+
- name: "Checkout"
38+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
39+
with:
40+
fetch-depth: 0
41+
42+
- name: "Download actionlint"
43+
run: |
44+
docker build --tag actionlint - < .github/workflows/actionlint.dockerfile
45+
46+
- name: "Check workflow files"
47+
run: |
48+
echo "::add-matcher::.github/workflows/matchers/actionlint.json"
49+
docker run --volume="${PWD}:/repo" --workdir=/repo actionlint -color

‎.github/workflows/format.yml‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎.github/workflows/lint.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Lint
2+
3+
on:
4+
push:
5+
branches:
6+
- "main"
7+
- "release-**"
8+
paths:
9+
- '**.py'
10+
- 'pyproject.toml'
11+
- 'tox.ini'
12+
- .pylintrc
13+
- '.github/workflows/lint.yml' # This workflow
14+
pull_request:
15+
branches:
16+
- "main"
17+
- "release-**"
18+
paths:
19+
- '**.py'
20+
- 'pyproject.toml'
21+
- 'tox.ini'
22+
- .pylintrc
23+
- '.github/workflows/lint.yml' # This workflow
24+
25+
env:
26+
LC_ALL: en_US.UTF-8
27+
28+
defaults:
29+
run:
30+
shell: bash
31+
32+
permissions:
33+
contents: read
34+
35+
jobs:
36+
lint:
37+
runs-on: ubuntu-latest
38+
name: "lint: ${{ matrix.lint.name }}"
39+
strategy:
40+
fail-fast: false
41+
matrix:
42+
lint:
43+
- name: "fmt"
44+
commands: |
45+
tox -e fmt
46+
- name: "pylint"
47+
commands: |
48+
echo "::add-matcher::.github/workflows/matchers/pylint.json"
49+
tox -e lint
50+
51+
steps:
52+
- name: "Harden Runner"
53+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
54+
with:
55+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
56+
57+
- name: "Checkout"
58+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
59+
with:
60+
# https://github.com/actions/checkout/issues/249
61+
fetch-depth: 0
62+
63+
- name: Setup Python 3.11
64+
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
65+
with:
66+
python-version: 3.11
67+
cache: pip
68+
cache-dependency-path: |
69+
**/pyproject.toml
70+
71+
- name: "Install tox"
72+
run: |
73+
python -m pip install --upgrade pip
74+
python -m pip install tox tox-gh
75+
76+
- name: "${{ matrix.lint.name }}"
77+
run: |
78+
${{ matrix.lint.commands }}

‎.github/workflows/matchers/actionlint.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"problemMatcher": [
3+
{
4+
"owner": "actionlint",
5+
"pattern": [
6+
{
7+
"regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
8+
"file": 1,
9+
"line": 2,
10+
"column": 3,
11+
"message": 4,
12+
"code": 5
13+
}
14+
]
15+
}
16+
]
17+
}
18+

‎.github/workflows/matchers/pylint.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"problemMatcher": [
3+
{
4+
"owner": "pylint-error",
5+
"severity": "error",
6+
"pattern": [
7+
{
8+
"regexp": "^(.+):(\\d+):(\\d+):\\s(([EF]\\d{4}):\\s.+)$",
9+
"file": 1,
10+
"line": 2,
11+
"column": 3,
12+
"message": 4,
13+
"code": 5
14+
}
15+
]
16+
},
17+
{
18+
"owner": "pylint-warning",
19+
"severity": "warning",
20+
"pattern": [
21+
{
22+
"regexp": "^(.+):(\\d+):(\\d+):\\s(([CRW]\\d{4}):\\s.+)$",
23+
"file": 1,
24+
"line": 2,
25+
"column": 3,
26+
"message": 4,
27+
"code": 5
28+
}
29+
]
30+
}
31+
]
32+
}
33+

‎.github/workflows/pypi.yml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
name: Build, test, and upload PyPI package
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- "release-**"
8+
tags:
9+
- "v*"
10+
pull_request:
11+
branches:
12+
- main
13+
- "release-**"
14+
release:
15+
types:
16+
- published
17+
18+
env:
19+
LC_ALL: en_US.UTF-8
20+
21+
defaults:
22+
run:
23+
shell: bash
24+
25+
permissions:
26+
contents: read
27+
28+
jobs:
29+
# Create and verify release artifacts
30+
# - build source dist (tar ball) and wheel
31+
# - validate artifacts with various tools
32+
# - upload artifacts to GHA
33+
build-package:
34+
name: Build and check packages
35+
runs-on: ubuntu-latest
36+
steps:
37+
- name: "Harden Runner"
38+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
39+
with:
40+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
41+
42+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
43+
with:
44+
# for setuptools-scm
45+
fetch-depth: 0
46+
47+
- uses: hynek/build-and-inspect-python-package@f01e4d047aadcc0c054c95ec9900da3ec3fc7a0f # v2.10.0
48+
49+
# push to Test PyPI on
50+
# - a new GitHub release is published
51+
# - a PR is merged into main branch
52+
publish-test-pypi:
53+
name: Publish packages to test.pypi.org
54+
# environment: publish-test-pypi
55+
if: |
56+
github.repository_owner == 'hickeyma' && (
57+
github.event.action == 'published' ||
58+
(github.event_name == 'push' && github.ref == 'refs/heads/main')
59+
)
60+
permissions:
61+
contents: read
62+
# see https://docs.pypi.org/trusted-publishers/
63+
id-token: write
64+
runs-on: ubuntu-latest
65+
needs: build-package
66+
67+
steps:
68+
- name: "Harden Runner"
69+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
70+
with:
71+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
72+
73+
- name: Fetch build artifacts
74+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
75+
with:
76+
name: Packages
77+
path: dist
78+
79+
- name: Upload to Test PyPI
80+
uses: pypa/gh-action-pypi-publish@15c56dba361d8335944d31a2ecd17d700fc7bcbc # v1.12.2
81+
with:
82+
repository-url: https://test.pypi.org/legacy/
83+
84+
# push to Production PyPI on
85+
# - a new GitHub release is published
86+
publish-pypi:
87+
name: Publish release to pypi.org
88+
# environment: publish-pypi
89+
if: |
90+
github.repository_owner == 'hickeyma' && github.event.action == 'published'
91+
permissions:
92+
# see https://docs.pypi.org/trusted-publishers/
93+
id-token: write
94+
# allow gh release upload
95+
contents: write
96+
97+
runs-on: ubuntu-latest
98+
needs: build-package
99+
100+
steps:
101+
- name: "Harden Runner"
102+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
103+
with:
104+
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
105+
106+
- name: Fetch build artifacts
107+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
108+
with:
109+
name: Packages
110+
path: dist
111+
112+
- uses: sigstore/gh-action-sigstore-python@f514d46b907ebcd5bedc05145c03b69c1edd8b46 # v3.0.0
113+
with:
114+
inputs: >-
115+
./dist/*.tar.gz
116+
./dist/*.whl
117+
release-signing-artifacts: false
118+
119+
# PyPI does not accept .sigstore artifacts and
120+
# gh-action-pypi-publish has no option to ignore them.
121+
- name: Remove sigstore signatures before uploading to PyPI
122+
run: rm ./dist/*.sigstore.json
123+
124+
- name: Upload to PyPI
125+
uses: pypa/gh-action-pypi-publish@15c56dba361d8335944d31a2ecd17d700fc7bcbc # v1.12.2

‎.github/workflows/test.yaml‎

Lines changed: 0 additions & 27 deletions
This file was deleted.

0 commit comments

Comments
 (0)