chore: Sign PyPi artifact #455
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR enhances the PyPI release workflow by adding GPG signing of distribution artifacts and switching to Twine for uploads.
- Imports the GPG key into the runner
- Signs wheel and tarball artifacts with GPG
- Replaces the
publib-pypistep withtwine upload
| env: | ||
| APIX_BOT_GPG_PASSPHRASE: ${{ secrets.APIX_BOT_GPG_PASSPHRASE }} | ||
|
|
||
| - name: Upload to PyPI |
There was a problem hiding this comment.
[nitpick] Consider using Twine's built-in --sign flag to both sign and upload artifacts in one command (e.g., twine upload --sign dist/*), which can simplify the workflow by removing the separate GPG step.
Co-authored-by: Copilot <[email protected]>
EspenAlbert
left a comment
EspenAlbert
left a comment
There was a problem hiding this comment.
Have we considered using https://github.com/pypa/gh-action-pypi-publish directly?
Not sure if we have access to pypi, but this way we wouldn't even need TWINE_USERNAME or TWINE_PASSWORD, with oidc the github action can use its own identity.
|
@EspenAlbert No I haven't considered using https://github.com/pypa/gh-action-pypi-publish. As far as I know, we don't have access to PyPi. I have tried to keep changes to a minimum. Since https://github.com/cdklabs/publib was using twine, I think there shouldn't be an issue to keep this way of publishing for now. |
| TWINE_USERNAME: ${{ secrets.TWINE_USERNAME }} | ||
| TWINE_PASSWORD: ${{ secrets.TWINE_PASSWORD }} | ||
| run: npx -p publib@latest publib-pypi | ||
| run: twine upload dist/* |
There was a problem hiding this comment.
Not able to test if we don't want to release 😆 , but I tried to keep changes to a minimum (do only what publib was doing)
There was a problem hiding this comment.
i understand, but just to make aware that we might have some issues in the next CDK release
There was a problem hiding this comment.
Agreed, we'll have to be careful on the next release
| with: | ||
| gpg_private_key: ${{ secrets.APIX_BOT_GPG_PRIVATE_KEY }} | ||
| passphrase: ${{ secrets.APIX_BOT_GPG_PASSPHRASE }} | ||
| - name: GPG sign PyPI distributions |
There was a problem hiding this comment.
This command I have tested, yes
Proposed changes
Signs artifacts released of PyPi
Link to any related issue(s): CLOUDP-321620
Type of change:
expected)
Required Checklist:
make fmtand formatted my codeFurther comments