CD - fix: harden script execution, config parsing, and CI release gate (#12) * fix: harden script execution, config parsing, and CI release gate Escape cmd.exe metacharacters in forwarded args, reject invalid and explosive script graphs, scope --no-hooks to pre-command argv, and run CI tests on main before publish. * fix: add missing ci-install run-script used by CI/CD * chore: ignore PLR0917 alongside existing too-many-args lint rule (from CI) #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CD | |
| run-name: CD - ${{ github.event_name == 'workflow_run' && format('{0} (from CI)', github.event.workflow_run.head_commit.message) || format('{0}{1}', github.event.inputs.environment != '' && github.event.inputs.environment || 'dev', github.event.inputs.version != '' && format(' (v{0})', github.event.inputs.version) || '') }} | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: "Release version" | |
| default: "None" | |
| required: false | |
| workflow_run: | |
| workflows: ["CI"] | |
| branches: [main] | |
| types: | |
| - completed | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: cd-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| CD: ${{ vars.CONTINUOUS_DEPLOYMENT }} | |
| VERSION: ${{ github.event.inputs.version != '' && github.event.inputs.version || 'None' }} | |
| jobs: | |
| # Continuous Deployment (CD) pipeline | |
| cd: | |
| if: ${{ vars.CONTINUOUS_DEPLOYMENT == 'true' && github.ref_name == 'main' && (github.event_name == 'workflow_dispatch' || (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')) }} | |
| permissions: | |
| contents: write | |
| id-token: write | |
| timeout-minutes: 15 | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest] | |
| platforms: [linux/amd64] | |
| steps: | |
| # Publish the exact commit that passed CI rather than whatever main points at now. | |
| - name: Checkout Git repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| ref: ${{ github.event.workflow_run.head_sha || github.ref }} | |
| fetch-depth: 0 | |
| - name: Install uv and set the Python version | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| - name: Install dependencies | |
| shell: bash | |
| run: uvx uvtask ci-install | |
| - name: Set version | |
| shell: bash | |
| env: | |
| GIT_ACTOR: ${{ github.actor }} | |
| GIT_ACTOR_ID: ${{ github.actor_id }} | |
| run: | | |
| if [ -z "${VERSION}" ] || [ "${VERSION}" = "None" ]; then | |
| LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0") | |
| uv version "${LAST_TAG}" | |
| uv version --bump minor | |
| VERSION=$(uv version --short) | |
| echo "VERSION=${VERSION}" >> "${GITHUB_ENV:-/dev/null}" | |
| else | |
| uv version "${VERSION}" | |
| fi | |
| git config user.name "${GIT_ACTOR}" | |
| git config user.email "${GIT_ACTOR_ID}+${GIT_ACTOR}@users.noreply.github.com" | |
| git tag -a "${VERSION}" -m "Release ${VERSION}" | |
| git push origin "${VERSION}" | |
| - name: Build package | |
| shell: bash | |
| run: uv build | |
| - name: Upload package to artifact registry | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: uvtask-${{ env.VERSION }} | |
| path: dist/ | |
| - name: Publish package | |
| shell: bash | |
| env: | |
| UV_PUBLISH_TOKEN: ${{ secrets.UV_PUBLISH_TOKEN }} | |
| run: uv publish | |
| - name: Clean | |
| if: always() | |
| shell: bash | |
| run: uvx uvtask clean |