Skip to content

Commit e231faf

Browse files
blink1073blink1073
authored
Simplify security handling (#434)
1 parent de4f93b commit e231faf

File tree

11 files changed

+151
-43
lines changed

11 files changed

+151
-43
lines changed

‎.github/actions/finalize-release/action.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ runs:
4040
then
4141
pip install -q git+https://github.com/jupyter-server/jupyter_releaser.git@v1
4242
fi
43+
4344
- id: finalize-release
4445
shell: bash -eux {0}
4546
run: |
@@ -51,3 +52,23 @@ runs:
5152
export RH_STEPS_TO_SKIP=${{ inputs.steps_to_skip }}
5253
export RH_BRANCH=${{ inputs.branch }}
5354
python -m jupyter_releaser.actions.finalize_release
55+
56+
- if: ${{ success() }}
57+
shell: bash -eux {0}
58+
run: |
59+
echo "## Next Step" >> $GITHUB_STEP_SUMMARY
60+
echo "Verify the final release" >> $GITHUB_STEP_SUMMARY
61+
echo ${{ steps.finalize-release.outputs.release_url }} >> $GITHUB_STEP_SUMMARY
62+
if [ ! -z "${{ steps.finalize-release.outputs.pr_url }}" ]; then
63+
echo "Merge the forwardport PR"
64+
echo ${{ steps.finalize-release.outputs.pr_url }}
65+
echo "Merge the forwardport PR" >> $GITHUB_STEP_SUMMARY
66+
echo ${{ steps.finalize-release.outputs.pr_url }} >> $GITHUB_STEP_SUMMARY
67+
fi
68+
69+
- if: ${{ failure() }}
70+
shell: bash -eux {0}
71+
run: |
72+
echo "## Failure Message" >> $GITHUB_STEP_SUMMARY
73+
echo ":x: Failed to Publish the Draft Release Url:" >> $GITHUB_STEP_SUMMARY
74+
echo ${{ inputs.release_url }} >> $GITHUB_STEP_SUMMARY

‎.github/actions/populate-release/action.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,3 +49,10 @@ runs:
4949
export RH_RELEASE_URL=${{ inputs.release_url }}
5050
export RH_BRANCH=${{ inputs.branch }}
5151
python -m jupyter_releaser.actions.populate_release
52+
53+
- if: ${{ failure() }}
54+
shell: bash -eux {0}
55+
run: |
56+
echo "## Failure Message" >> $GITHUB_STEP_SUMMARY
57+
echo ":x: Failed to Publish the Draft Release Url:" >> $GITHUB_STEP_SUMMARY
58+
echo ${{ steps.populate-release.outputs.release_url }} >> $GITHUB_STEP_SUMMARY

‎.github/actions/prep-release/action.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,3 +59,9 @@ runs:
5959
export RH_SINCE_LAST_STABLE=${{ inputs.since_last_stable }}
6060
6161
python -m jupyter_releaser.actions.prep_release
62+
63+
- shell: bash -eux {0}
64+
run: |
65+
echo "## Next Step" >> $GITHUB_STEP_SUMMARY
66+
echo "(Optional): Review Draft Release: ${{ steps.prep-release.outputs.release_url }}" >> $GITHUB_STEP_SUMMARY
67+
echo "Run Step 2: Publish Release workflow"

‎.github/workflows/prep-release.yml‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,8 @@ on:
2525
jobs:
2626
prep_release:
2727
runs-on: ubuntu-latest
28-
strategy:
29-
fail-fast: true
30-
matrix:
31-
python-version: ["3.10"]
3228
steps:
33-
- name: Checkout
34-
uses: actions/checkout@v2
35-
36-
- name: Setup
37-
uses: jupyter-server/jupyter_releaser/.github/actions/common@v2
38-
29+
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
3930
- name: Prep Release
4031
id: prep-release
4132
uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@v2
@@ -51,6 +42,3 @@ jobs:
5142
- name: "** Next Step **"
5243
run: |
5344
echo "Optional): Review Draft Release: ${{ steps.prep-release.outputs.release_url }}"
54-
echo "## Next Step" >> $GITHUB_STEP_SUMMARY
55-
echo "(Optional): Review Draft Release: ${{ steps.prep-release.outputs.release_url }}" >> $GITHUB_STEP_SUMMARY
56-
echo "Run Step 2: Publish Release workflow"

‎.github/workflows/publish-release.yml‎

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,8 @@ on:
1818
jobs:
1919
publish_release:
2020
runs-on: ubuntu-latest
21-
strategy:
22-
fail-fast: true
23-
matrix:
24-
python-version: ["3.10"]
2521
steps:
26-
- name: Checkout
27-
uses: actions/checkout@v2
28-
29-
- name: Setup
30-
uses: jupyter-server/jupyter_releaser/.github/actions/common@v2
31-
22+
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
3223
- name: Populate Release
3324
id: populate-release
3425
uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@v2
@@ -57,21 +48,9 @@ jobs:
5748
run: |
5849
echo "Verify the final release"
5950
echo ${{ steps.finalize-release.outputs.release_url }}
60-
echo "## Next Step" >> $GITHUB_STEP_SUMMARY
61-
echo "Verify the final release" >> $GITHUB_STEP_SUMMARY
62-
echo ${{ steps.finalize-release.outputs.release_url }} >> $GITHUB_STEP_SUMMARY
63-
if [ ! -z "${{ steps.finalize-release.outputs.pr_url }}" ]; then
64-
echo "Merge the forwardport PR"
65-
echo ${{ steps.finalize-release.outputs.pr_url }}
66-
echo "Merge the forwardport PR" >> $GITHUB_STEP_SUMMARY
67-
echo ${{ steps.finalize-release.outputs.pr_url }} >> $GITHUB_STEP_SUMMARY
68-
fi
6951
7052
- name: "** Failure Message **"
7153
if: ${{ failure() }}
7254
run: |
7355
echo "Failed to Publish the Draft Release Url:"
7456
echo ${{ steps.populate-release.outputs.release_url }}
75-
echo "## Failure Message" >> $GITHUB_STEP_SUMMARY
76-
echo ":x: Failed to Publish the Draft Release Url:" >> $GITHUB_STEP_SUMMARY
77-
echo ${{ steps.populate-release.outputs.release_url }} >> $GITHUB_STEP_SUMMARY

‎.pre-commit-config.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,13 @@ repos:
7272
types: [yaml]
7373
args: ["--schemafile", "https://json.schemastore.org/github-workflow"]
7474
stages: [manual]
75+
76+
- repo: https://github.com/sirosen/check-jsonschema
77+
rev: 0.18.3
78+
hooks:
79+
- id: check-jsonschema
80+
name: "Check Example Workflows"
81+
files: ^example-workflows/
82+
types: [yaml]
83+
args: ["--schemafile", "https://json.schemastore.org/github-workflow"]
84+
stages: [manual]

‎docs/source/get_started/making_release_from_repo.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ already uses Jupyter Releaser using workflows on its own repository.
66
## Prerequisites
77

88
- Admin write access to the target repository
9-
- Previously set up GitHub Actions secrets and tag protection.
9+
- Previously set up GitHub Actions secrets for PyPI and/or NPM
1010

1111
## Prep Release
1212

‎docs/source/how_to_guides/convert_repo_from_repo.md‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,10 @@ See [checklist](#Checklist-for-Adoption) below for details:
1414

1515
## Checklist for Adoption
1616

17-
- [ ] Add a [GitHub Access token](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) with access to target GitHub repo to run GitHub Actions, saved as
18-
`ADMIN_GITHUB_TOKEN` in the [repository secrets](https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository).
19-
The token needs to have `public_repo` and `repo:status` permissions.
2017
- [ ] Add access token for the [PyPI registry](https://packaging.python.org/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#saving-credentials-on-github) stored as `PYPI_TOKEN`.
2118
_Note_ For security reasons, it is recommended that you scope the access
22-
to a single repository.
19+
to a single repository. Additionally, this token should belong to a
20+
bot account and not a single user.
2321
- [ ] If needed, add access token for [npm](https://docs.npmjs.com/creating-and-viewing-access-tokens), saved as `NPM_TOKEN`.
2422
- [ ] Ensure that only trusted users with 2FA have admin access to the
2523
repository, since they will be able to trigger releases.
@@ -76,8 +74,7 @@ _Note_ The check release action needs `contents: write` [permission](https://doc
7674

7775
- [ ] Update or add `RELEASE.md` that describes the onboarding and release process, e.g.
7876

79-
- [ ] Copy `prep-release.yml` and `publish-release.yml` from this repository
80-
and remove the "target" input, since the target will be your own repo.
77+
- [ ] Copy `prep-release.yml` and `publish-release.yml` from the `example-workflows` folder in this repository.
8178

8279
- [ ] Optionally add [configuration](#Configuration) to the repository if non-standard options or hooks are needed.
8380

‎example-workflows/prep-release.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: "Step 1: Prep Release"
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
version_spec:
6+
description: "New Version Specifier"
7+
default: "next"
8+
required: false
9+
branch:
10+
description: "The branch to target"
11+
required: false
12+
post_version_spec:
13+
description: "Post Version Specifier"
14+
required: false
15+
since:
16+
description: "Use PRs with activity since this date or git reference"
17+
required: false
18+
since_last_stable:
19+
description: "Use PRs with activity since the last stable git tag"
20+
required: false
21+
type: boolean
22+
jobs:
23+
prep_release:
24+
permissions:
25+
contents: write
26+
runs-on: ubuntu-latest
27+
steps:
28+
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
29+
30+
- name: Prep Release
31+
id: prep-release
32+
uses: jupyter-server/jupyter_releaser/.github/actions/prep-release@v2
33+
with:
34+
token: ${{ secrets.GITHUB_TOKEN }}
35+
version_spec: ${{ github.event.inputs.version_spec }}
36+
post_version_spec: ${{ github.event.inputs.post_version_spec }}
37+
target: ${{ github.event.inputs.target }}
38+
branch: ${{ github.event.inputs.branch }}
39+
since: ${{ github.event.inputs.since }}
40+
since_last_stable: ${{ github.event.inputs.since_last_stable }}
41+
42+
- name: "** Next Step **"
43+
run: |
44+
echo "Optional): Review Draft Release: ${{ steps.prep-release.outputs.release_url }}"

‎example-workflows/publish-release.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: "Step 2: Publish Release"
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
branch:
6+
description: "The target branch"
7+
required: false
8+
release_url:
9+
description: "The URL of the draft GitHub release"
10+
required: false
11+
steps_to_skip:
12+
description: "Comma separated list of steps to skip"
13+
required: false
14+
15+
jobs:
16+
publish_release:
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: write
20+
steps:
21+
- uses: jupyterlab/maintainer-tools/.github/actions/base-setup@v1
22+
23+
- name: Populate Release
24+
id: populate-release
25+
uses: jupyter-server/jupyter_releaser/.github/actions/populate-release@v2
26+
with:
27+
token: ${{ secrets.GITHUB_TOKEN }}
28+
target: ${{ github.event.inputs.target }}
29+
branch: ${{ github.event.inputs.branch }}
30+
release_url: ${{ github.event.inputs.release_url }}
31+
steps_to_skip: ${{ github.event.inputs.steps_to_skip }}
32+
33+
- name: Finalize Release
34+
id: finalize-release
35+
env:
36+
PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
37+
PYPI_TOKEN_MAP: ${{ secrets.PYPI_TOKEN_MAP }}
38+
TWINE_USERNAME: __token__
39+
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
40+
uses: jupyter-server/jupyter-releaser/.github/actions/finalize-release@v2
41+
with:
42+
token: ${{ secrets.GITHUB_TOKEN }}
43+
target: ${{ github.event.inputs.target }}
44+
release_url: ${{ steps.populate-release.outputs.release_url }}
45+
46+
- name: "** Next Step **"
47+
if: ${{ success() }}
48+
run: |
49+
echo "Verify the final release"
50+
echo ${{ steps.finalize-release.outputs.release_url }}
51+
52+
- name: "** Failure Message **"
53+
if: ${{ failure() }}
54+
run: |
55+
echo "Failed to Publish the Draft Release Url:"
56+
echo ${{ steps.populate-release.outputs.release_url }}

0 commit comments

Comments
 (0)