11name : Publish
22on :
33 push :
4- tags :
5- - ' *'
4+ tags : ['*']
65 # When a new version of Python is released, the workflow can be run manually to
76 # publish new wheels for the existing tag.
87 workflow_dispatch :
1615jobs :
1716 sdist :
1817 runs-on : ubuntu-latest
18+ outputs :
19+ hash : ${{ steps.hash.outputs.hash }}
1920 steps :
2021 - uses : actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2122 with :
2223 ref : ${{ inputs.tag }}
23- - uses : actions /setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3 .0
24+ - uses : astral-sh /setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6.1 .0
2425 with :
25- python-version : ' 3.x '
26- cache : pip
27- cache-dependency-path : requirements/*.txt
28- - run : pip install -r requirements/build.txt
29- # Use the commit date instead of the current date during the build.
26+ enable-cache : true
27+ prune- cache : false
28+ - uses : actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
29+ with :
30+ python-version-file : pyproject.toml
3031 - run : echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
31- - run : python -m build --sdist
32- - uses : actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
32+ - run : uv build --sdist
33+ - uses : actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
3334 with :
3435 name : build-sdist
3536 path : ./dist
@@ -45,22 +46,26 @@ jobs:
4546 os : [ubuntu-latest, windows-latest, macos-latest]
4647 steps :
4748 - uses : actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
48- - run : echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
49+ - uses : astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6.1.0
50+ with :
51+ enable-cache : true
52+ prune-cache : false
4953 - name : Set up QEMU
5054 if : runner.os == 'Linux'
51- uses : docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2 .0
55+ uses : docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6 .0
5256 with :
5357 platforms : arm64
54- - uses : pypa/cibuildwheel@7940a4c0e76eb2030e473a5f864f291f63ee879b # v2.21.3
58+ - run : echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
59+ - uses : pypa/cibuildwheel@faf86a6ed7efa889faf6996aa23820831055001a # v2.23.3
5560 env :
5661 # For workflow_dispatch, only build the new Python version.
5762 CIBW_BUILD : ${{ inputs.python && format('{0}-*', inputs.python) || null }}
5863 CIBW_SKIP : pp*
5964 CIBW_ARCHS_LINUX : auto aarch64
6065 CIBW_ARCHS_MACOS : auto universal2
61- CIBW_BUILD_FRONTEND : build
62- CIBW_FREE_THREADED_SUPPORT : 1
63- - uses : actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
66+ CIBW_ENABLE : cpython-freethreading
67+ CIBW_BUILD_FRONTEND : build[uv]
68+ - uses : actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
6469 with :
6570 name : build-wheels-${{ matrix.os }}
6671 path : ./wheelhouse
7176 outputs :
7277 hash : ${{ steps.hash.outputs.hash }}
7378 steps :
74- - uses : actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
79+ - uses : actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
7580 with :
7681 path : dist
7782 pattern : build-*
8691 id-token : write
8792 contents : write
8893 # Can't pin with hash due to how this workflow works.
89- uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0 .0
94+ uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1 .0
9095 with :
9196 base64-subjects : ${{ needs.hash.outputs.hash }}
9297 # When building more wheels, use the Python version as the provenance file name.
@@ -99,12 +104,12 @@ jobs:
99104 permissions :
100105 contents : write
101106 steps :
102- - uses : actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
107+ - uses : actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
103108 with :
104109 path : dist
105110 pattern : build-*
106111 merge-multiple : true
107- - uses : actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
112+ - uses : actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
108113 with :
109114 pattern : ' *.intoto.jsonl'
110115 # When building a new tag, create a new draft release.
@@ -136,15 +141,11 @@ jobs:
136141 permissions :
137142 id-token : write
138143 steps :
139- - uses : actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
144+ - uses : actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
140145 with :
141146 path : dist
142147 pattern : build-*
143148 merge-multiple : true
144- - uses : pypa/gh-action-pypi-publish@f7600683efdcb7656dec5b29656edb7bc586e597 # v1.10.3
145- with :
146- repository-url : https://test.pypi.org/legacy/
147- skip-existing : true
148- - uses : pypa/gh-action-pypi-publish@f7600683efdcb7656dec5b29656edb7bc586e597 # v1.10.3
149+ - uses : pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
149150 with :
150151 skip-existing : true
0 commit comments