Add SLSA generic generator to publish workflow
MODIFY
.github/PULL_REQUEST_TEMPLATE/release.md
.github/PULL_REQUEST_TEMPLATE/release.md
git push <REMOTE> --tags
```
* [ ] Execute the `publish` GitHub workflow. This requires a review from a maintainer.
-* [ ] Download the sdist and wheel files from PyPI. Attach these files to the GitHub release.
-* [ ] Download the `.crt` and `.sig` files from the `sigstore-artifacts` artifact in the `publish` workflow execution. Attach these files to the GitHub release.
+* [ ] Ensure that all expected artifacts are added to the new GitHub release. Should
+ be one `.whl`, one `.tar.gz`, and one `urllib3.intoto.jsonl`. Update the GitHub
+ release to have the content of the release's changelog.
* [ ] Announce on:
-
- * [ ] GitHub releases
* [ ] Twitter
* [ ] Discord
* [ ] OpenCollective
- * [ ] GitCoin Grants
* [ ] Update Tidelift metadata
* [ ] If this was a 1.26.x release, add changelog to the `main` branch

MODIFY
.github/workflows/publish.yml
.github/workflows/publish.yml
@@ -11,8 +11,8 @@ permissions:
id-token: "write"
jobs:
- publish:
- name: "Publish to PyPI"
+ build:
+ name: "Build dists"
runs-on: "ubuntu-latest"
environment:
name: "publish"
@@ -34,36 +34,51 @@ jobs:
SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) \
python -m build
- - name: "Sign dists"
+ - name: "Generate hashes"
+ id: hash
run: |
- mkdir -p sigstore-artifacts/
-
- for dist in dist/*; do
- dist_name=$(basename "${dist}")
+ cd dist && echo "::set-output name=hashes::$(sha256sum * | base64 -w0)"
- # Sign the dists and then verify them immediately
- # with the generated artifacts.
- python -m \
- sigstore sign "${dist}" \
- --output-signature sigstore-artifacts/"${dist_name}.sig" \
- --output-certificate sigstore-artifacts/"${dist_name}.crt"
+ - name: "Upload dists"
+ uses: "actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8"
+ with:
+ name: "dist"
+ path: "dist/"
+ if-no-files-found: error
+ retention-days: 5
- python -m \
- sigstore verify "${dist}" \
- --cert "sigstore-artifacts/${dist_name}.crt" \
- --signature "sigstore-artifacts/${dist_name}.sig" \
- --cert-oidc-issuer https://token.actions.githubusercontent.com
+ provenance:
+ needs: [build]
+ permissions:
+ actions: read
+ contents: write
+ id-token: write
+ uses: "slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.2.0"
+ with:
+ base64-subjects: "${{ needs.build.outputs.hashes }}"
+ attestation-name: "urllib3.intoto.jsonl"
+ upload-assets: true
- done
+ publish:
+ name: "Publish"
+ if: startsWith(github.ref, 'refs/tags/')
+ needs: ["build", "provenance"]
+ runs-on: "ubuntu-latest"
- - name: "Upload artifacts"
- uses: "actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8"
+ steps:
+ - name: "Download dists"
+ uses: "actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741"
with:
- name: "sigstore-artifacts"
- path: "sigstore-artifacts/*"
- if-no-files-found: "error"
+ name: "dist"
+ path: "dist/"
+
+ - name: "Upload dists to GitHub Release"
+ env:
+ GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+ run: |
+ gh release upload ${{ github.ref_name }} dist/* --repo ${{ github.repository }}
- - name: "Publish to PyPI"
+ - name: "Publish dists to PyPI"
uses: "pypa/gh-action-pypi-publish@37f50c210e3d2f9450da2cd423303d6a14a6e29f"
with:
user: __token__

Add SLSA generic generator to publish workflow