release.yml

name: Release

on:
  release:
    types:
      - published

permissions: # added using https://github.com/step-security/secure-workflows
  contents: read

jobs:
  build:
    name: Build and sign artifacts
    runs-on: ubuntu-latest
    permissions:
      id-token: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          # NOTE: We intentionally don't use a cache in the release step,
          # to reduce the risk of cache poisoning.
          python-version: "3.x"

      - name: deps
        run: python -m pip install -U build

      - name: build
        run: python -m build

      - name: sign
        run: |
          mkdir -p smoketest-artifacts

          # we smoke-test sigstore by installing each of the distributions
          # we've built in a fresh environment and using each to sign and
          # verify for itself, using the ambient OIDC identity
          for dist in dist/*; do
            dist_base="$(basename "${dist}")"

            python -m venv smoketest-env

            ./smoketest-env/bin/python -m pip install "${dist}"

            # NOTE: signing artifacts currently go in a separate directory,
            # to avoid confusing the package uploader (which otherwise tries
            # to upload them to PyPI and fails). Future versions of twine
            # and the gh-action-pypi-publish action should support these artifacts.
            ./smoketest-env/bin/python -m \
              sigstore sign "${dist}" \
              --output-signature smoketest-artifacts/"${dist_base}.sig" \
              --output-certificate smoketest-artifacts/"${dist_base}.crt" \
              --bundle smoketest-artifacts/"${dist_base}.sigstore"

            # Verify using `.sig` `.crt` pair;
            ./smoketest-env/bin/python -m \
              sigstore verify identity "${dist}" \
              --signature "smoketest-artifacts/${dist_base}.sig" \
              --cert "smoketest-artifacts/${dist_base}.crt" \
              --cert-oidc-issuer https://token.actions.githubusercontent.com \
              --cert-identity ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/.github/workflows/release.yml@${GITHUB_REF}

            # Verify using `.sigstore` bundle;
            ./smoketest-env/bin/python -m \
              sigstore verify identity "${dist}" \
              --bundle "smoketest-artifacts/${dist_base}.sigstore" \
              --cert-oidc-issuer https://token.actions.githubusercontent.com \
              --cert-identity ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/.github/workflows/release.yml@${GITHUB_REF}

            rm -rf smoketest-env
          done

      - name: Upload built packages
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: built-packages
          path: ./dist/
          if-no-files-found: warn

      - name: Upload smoketest-artifacts
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: smoketest-artifacts
          path: smoketest-artifacts/
          if-no-files-found: warn

  generate-provenance:
    needs: [build]
    runs-on: ubuntu-latest
    permissions:
      id-token: write # To sign the provenance.
      attestations: write # To persist the attestation files.
    steps:
      - name: Download artifacts directories # goes to current working directory
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      - name: Generate build provenance
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: 'built-packages/*'

  release-pypi:
    needs: [build, generate-provenance]
    runs-on: ubuntu-latest
    permissions:
      # Used to authenticate to PyPI via OIDC.
      id-token: write
    steps:
      - name: Download artifacts directories # goes to current working directory
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

      - name: publish
        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
        with:
          packages-dir: built-packages/

  release-github:
    needs: [build, generate-provenance]
    runs-on: ubuntu-latest
    permissions:
      # Needed to upload release assets.
      contents: write
    steps:
      - name: Download artifacts directories # goes to current working directory
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

      - name: Upload artifacts to github
        # Confusingly, this action also supports updating releases, not
        # just creating them. This is what we want here, since we've manually
        # created the release that triggered the action.
        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
        with:
          # smoketest-artifacts/ contains the signatures and certificates.
          files: |
            built-packages/*

  # Trigger workflow to generate pinned requirements.txt.
  pin-requirements:
    permissions:
      # Needed to create branch and pull request.
      pull-requests: write
      contents: write
    # Workflow depends on uploaded release assets.
    needs: [release-github]
    # Only trigger workflow on full releases.
    if: ${{ !github.event.release.prerelease }}
    uses: ./.github/workflows/pin-requirements.yml
    with:
      tag: ${{ github.ref_name }}