Add release signing and lockfile checks #143
Conversation
There was a problem hiding this comment.
Pull request overview
This PR enhances the release process with supply chain security features and adds lockfile validation to the CI pipeline. It introduces Sigstore-based signing for release artifacts, SBOM generation for dependency tracking, and automated upload of these assets to GitHub releases. Additionally, it adds a lockfile freshness check to ensure the uv.lock file stays in sync with dependencies.
Key Changes:
- Added lockfile freshness validation to the code quality workflow
- Extended publish workflow with SBOM generation (CycloneDX format) and Sigstore signing
- Automated upload of wheels, source distributions, signatures, certificates, and SBOM to GitHub releases
- Documented the new release assets and signature verification process in README
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
.github/workflows/code_quality.yml |
Adds uv lock --check step to verify lockfile is up-to-date with pyproject.toml |
.github/workflows/publish.yml |
Extends workflow with Syft SBOM generation, Sigstore signing, and automated release asset uploads; adds contents: write permission |
README.md |
Documents release assets (SBOM, signatures, certificates) and provides verification instructions using Sigstore CLI |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Jackson Antonio do Prado Lima <jacksonpradolima@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Jackson Antonio do Prado Lima <jacksonpradolima@users.noreply.github.com>
|
@jacksonpradolima I've opened a new pull request, #150, to work on those changes. Once the pull request is ready, I'll request review from you. |
|
@jacksonpradolima I've opened a new pull request, #151, to work on those changes. Once the pull request is ready, I'll request review from you. |
Co-authored-by: jacksonpradolima <7774063+jacksonpradolima@users.noreply.github.com>
Change to dist/ directory before signing to ensure .sig and .pem files are created in the correct location for the upload step. Co-authored-by: jacksonpradolima <7774063+jacksonpradolima@users.noreply.github.com>
|
@jacksonpradolima I've opened a new pull request, #152, to work on those changes. Once the pull request is ready, I'll request review from you. |
Co-authored-by: jacksonpradolima <7774063+jacksonpradolima@users.noreply.github.com>
|
jacksonpradolima
deleted the
codex/add-release-verification-workflow-steps
branch
Summary
Testing
Codex Task