Skip to content

Commit 068fdaa

Browse files
bckohanbckohan
committed
update actions
1 parent a3dc55a commit 068fdaa

File tree

5 files changed

+207
-30
lines changed

5 files changed

+207
-30
lines changed

‎.github/workflows/lint.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ permissions: read-all
55
on:
66
push:
77
pull_request:
8+
workflow_call:
89
workflow_dispatch:
910
inputs:
1011
debug:

‎.github/workflows/release.yml‎

Lines changed: 142 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,153 @@
1-
name: release
21

3-
on:
4-
release:
5-
types: [published]
2+
name: Publish Release
3+
4+
permissions: read-all
65

6+
on:
7+
push:
8+
tags:
9+
- 'v*' # only publish on version tags (e.g. v1.0.0)
710

811
jobs:
12+
13+
lint:
14+
uses: ./.github/workflows/lint.yml
15+
secrets: inherit
16+
917
test:
1018
uses: ./.github/workflows/test.yml
1119
secrets: inherit
1220

13-
pypi:
21+
build:
22+
name: Build Package
1423
runs-on: ubuntu-latest
15-
needs: test
16-
environment: release
1724
permissions:
18-
contents: write
19-
id-token: write
25+
actions: write
26+
outputs:
27+
PACKAGE_NAME: ${{ steps.set-package.outputs.package_name }}
2028
steps:
21-
- uses: actions/checkout@v4
22-
23-
- name: Install uv
24-
uses: astral-sh/setup-uv@v5
25-
with:
26-
enable-cache: true
27-
28-
- name: Build package
29-
run: |
30-
uv build
31-
32-
- name: Upload release assets to GitHub
33-
env:
34-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
35-
run: |
36-
gh release upload ${{ github.event.release.tag_name }} ./dist/*
37-
38-
- name: Publish to PyPI
39-
run: |
40-
uv publish
29+
- uses: actions/checkout@v4
30+
- name: Set up Python
31+
uses: actions/setup-python@v5
32+
with:
33+
python-version: ">=3.11" # for tomlib
34+
- name: Verify Tag Signature
35+
run: |
36+
TAG_NAME=${GITHUB_REF#refs/tags/}
37+
echo "Verifying tag $TAG_NAME..."
38+
git tag -v "$TAG_NAME"
39+
- name: Install pypa/build
40+
run:
41+
python3 -m pip install build --user
42+
- name: Build a binary wheel and a source tarball
43+
run: python3 -m build
44+
- name: Store the distribution packages
45+
uses: actions/upload-artifact@v4
46+
with:
47+
name: python-package-distributions
48+
path: dist/
49+
- name: Set Package Name
50+
id: set-package
51+
run:
52+
PACKAGE_NAME=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml', 'rb'))['project']['name'])")
53+
echo "PACKAGE_NAME=${PACKAGE_NAME}" >> $GITHUB_ENV
54+
55+
publish-to-pypi:
56+
name: Publish to PyPI
57+
needs:
58+
- lint
59+
- test
60+
- build
61+
- publish-to-testpypi
62+
runs-on: ubuntu-latest
63+
environment:
64+
name: pypi
65+
url: https://pypi.org/p/${{ needs.build.outputs.PACKAGE_NAME }}
66+
permissions:
67+
id-token: write # IMPORTANT: mandatory for trusted publishing
68+
steps:
69+
- name: Download all the dists
70+
uses: actions/download-artifact@v4
71+
with:
72+
name: python-package-distributions
73+
path: dist/
74+
- name: Publish distribution 📦 to PyPI
75+
uses: pypa/gh-action-pypi-publish@release/v1.12
76+
77+
github-release:
78+
name: Publish GitHub Release
79+
runs-on: ubuntu-latest
80+
needs:
81+
- lint
82+
- test
83+
- build
84+
permissions:
85+
contents: write # IMPORTANT: mandatory for making GitHub Releases
86+
id-token: write # IMPORTANT: mandatory for sigstore
87+
88+
steps:
89+
- name: Download all the dists
90+
uses: actions/download-artifact@v4
91+
with:
92+
name: python-package-distributions
93+
path: dist/
94+
- name: Sign the dists with Sigstore
95+
uses: sigstore/gh-action-sigstore-python@v3.0.0
96+
with:
97+
inputs: >-
98+
./dist/*.tar.gz
99+
./dist/*.whl
100+
- name: Create GitHub Release
101+
env:
102+
GITHUB_TOKEN: ${{ github.token }}
103+
run: >-
104+
gh release create
105+
'${{ github.ref_name }}'
106+
--repo '${{ github.repository }}'
107+
--generate-notes
108+
- name: Upload artifact signatures to GitHub Release
109+
env:
110+
GITHUB_TOKEN: ${{ github.token }}
111+
# Upload to GitHub Release using the `gh` CLI.
112+
# `dist/` contains the built packages, and the
113+
# sigstore-produced signatures and certificates.
114+
run: >-
115+
gh release upload
116+
'${{ github.ref_name }}' dist/**
117+
--repo '${{ github.repository }}'
118+
119+
publish-to-testpypi:
120+
name: Publish to TestPyPI
121+
needs:
122+
- build
123+
runs-on: ubuntu-latest
124+
125+
environment:
126+
name: testpypi
127+
url: https://test.pypi.org/project/${{ needs.build.outputs.PACKAGE_NAME }}
128+
129+
permissions:
130+
id-token: write # IMPORTANT: mandatory for trusted publishing
131+
132+
steps:
133+
- name: Download all the dists
134+
uses: actions/download-artifact@v4
135+
with:
136+
name: python-package-distributions
137+
path: dist/
138+
- name: Publish distribution 📦 to TestPyPI
139+
uses: pypa/gh-action-pypi-publish@release/v1.12
140+
with:
141+
repository-url: https://test.pypi.org/legacy/
142+
skip-existing: true
143+
144+
# TODO fetch-data requires login
145+
# notify-django-packages:
146+
# name: Notify Django Packages
147+
# runs-on: ubuntu-latest
148+
# needs:
149+
# - publish-to-pypi
150+
# steps:
151+
# - name: Notify Django Packages
152+
# run:
153+
# curl -X GET "https://djangopackages.org/packages/django-typer/fetch-data/"

‎.github/workflows/scorecard.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: OpenSSF Scorecard
2+
on:
3+
# For Branch-Protection check. Only the default branch is supported. See
4+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
5+
branch_protection_rule:
6+
# To guarantee Maintained check is occasionally updated. See
7+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
8+
push:
9+
branches: [ main ]
10+
11+
permissions: read-all
12+
13+
jobs:
14+
analysis:
15+
name: Scorecard analysis
16+
runs-on: ubuntu-latest
17+
permissions:
18+
security-events: write
19+
id-token: write
20+
21+
steps:
22+
- name: "Checkout code"
23+
uses: actions/checkout@v4
24+
with:
25+
persist-credentials: false
26+
27+
- name: "Run analysis"
28+
uses: ossf/scorecard-action@v2.4.0
29+
with:
30+
results_file: results.sarif
31+
results_format: sarif
32+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
33+
# - you want to enable the Branch-Protection check on a *public* repository, or
34+
# - you are installing Scorecard on a *private* repository
35+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
36+
repo_token: ${{ secrets.SCORECARD_TOKEN }}
37+
38+
# Public repositories:
39+
# - Publish results to OpenSSF REST API for easy access by consumers
40+
# - Allows the repository to include the Scorecard badge.
41+
# - See https://github.com/ossf/scorecard-action#publishing-results.
42+
# For private repositories:
43+
# - `publish_results` will always be set to `false`, regardless
44+
# of the value entered here.
45+
publish_results: true
46+
47+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
48+
# format to the repository Actions tab.
49+
- name: "Upload artifact"
50+
uses: actions/upload-artifact@v4
51+
with:
52+
name: SARIF file
53+
path: results.sarif
54+
retention-days: 5
55+
56+
# Upload the results to GitHub's code scanning dashboard (optional).
57+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
58+
- name: "Upload to code-scanning"
59+
uses: github/codeql-action/upload-sarif@v3
60+
with:
61+
sarif_file: results.sarif

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
[![Code Cov](https://codecov.io/gh/bckohan/django-enum/branch/main/graph/badge.svg?token=0IZOKN2DYL)](https://codecov.io/gh/bckohan/django-enum)
1111
[![Test Status](https://github.com/bckohan/django-enum/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/bckohan/django-enum/actions/workflows/test.yml?query=branch:main)
1212
[![Lint Status](https://github.com/bckohan/django-enum/actions/workflows/lint.yml/badge.svg?branch=main)](https://github.com/bckohan/django-enum/actions/workflows/lint.yml?query=branch:main)
13-
13+
[![Published on Django Packages](https://img.shields.io/badge/Published%20on-Django%20Packages-0c3c26)](https://djangopackages.org/packages/p/django-enum/)
1414

1515
---------------------------------------------------------------------------------------------------
1616

‎SECURITY.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
# Security Policy
22

3+
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/bckohan/django-enum/badge)](https://securityscorecards.dev/viewer/?uri=github.com/bckohan/django-enum)
4+
35
## Supported Versions
46

57
Only the latest version [![PyPI version](https://badge.fury.io/py/django-render-static.svg)](https://pypi.python.org/pypi/django-render-static) is supported.

0 commit comments

Comments
 (0)