ADR-toolkit/.github/workflows/release.yml at master · SHcommit/ADR-toolkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# .github/workflows/release.yml
name: release

on:
  push:
    tags:
      - "v*"

concurrency:
  group: release-${{ github.workflow }}
  cancel-in-progress: false

jobs:
  release:
    runs-on: ubuntu-latest
    # softprops/action-gh-release needs write access to create the release;
    # the default GITHUB_TOKEN is read-only for repos created since Feb 2023.
    # attest-build-provenance needs id-token (to mint an OIDC token for
    # Sigstore's keyless signing) and attestations: write (to publish the
    # resulting attestation to the repo) -- no private key to manage or
    # rotate; every install/consumption path here references the git repo
    # or this packaged skill folder directly (docs/adr-toolkit-audit-report.md
    # §2.2 2.2), so provenance tied to the exact commit is what actually
    # matters, not a signed build of something nobody downloads separately.
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install pytest build
      - name: Run tests
        run: python -m pytest tests/unit tests/integration -v
      - name: Check manifest versions are in sync
        run: python scripts/sync_version.py --check
      - name: Verify tag matches VERSION
        run: |
          test "v$(cat skills/adr-toolkit/VERSION)" = "$GITHUB_REF_NAME" \
            || { echo "tag $GITHUB_REF_NAME != v$(cat skills/adr-toolkit/VERSION)"; exit 1; }
      - name: Package the distributable skill
        id: package
        run: |
          set -euo pipefail
          VERSION="$(cat skills/adr-toolkit/VERSION)"
          ARCHIVE="adr-toolkit-skill-v${VERSION}.tar.gz"
          tar -czf "$ARCHIVE" -C skills adr-toolkit
          sha256sum "$ARCHIVE" > "${ARCHIVE}.sha256"
          echo "archive=$ARCHIVE" >> "$GITHUB_OUTPUT"
      - name: Build Python wheel and sdist package
        run: python -m build
      - name: Generate build provenance attestation
        if: ${{ !github.event.repository.private }}
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: ${{ steps.package.outputs.archive }}
      - name: Create GitHub Release
        uses: softprops/action-gh-release@v2
        with:
          generate_release_notes: true
          files: |
            ${{ steps.package.outputs.archive }}
            ${{ steps.package.outputs.archive }}.sha256
            dist/*.whl
            dist/*.tar.gz
      - name: Publish Python Package to PyPI
        if: ${{ !github.event.repository.private }}
        uses: pypa/gh-action-pypi-publish@release/v1
        continue-on-error: true
        with:
          skip-existing: true