1
1
name : Publish
2
2
on :
3
3
push :
4
- tags :
5
- - ' *'
4
+ tags : ['*']
6
5
jobs :
7
6
build :
8
7
runs-on : ubuntu-latest
9
8
outputs :
10
9
hash : ${{ steps.hash.outputs.hash }}
11
10
steps :
12
- - uses : actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
13
- - uses : actions /setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5 .1.1
11
+ - uses : actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
12
+ - uses : astral-sh /setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v6 .1.0
14
13
with :
15
- python-version : ' 3.x '
16
- cache : pip
17
- cache-dependency-path : requirements*/*.txt
18
- - run : pip install -r requirements/build.txt
19
- # Use the commit date instead of the current date during the build.
14
+ enable-cache : true
15
+ prune- cache : false
16
+ - uses : actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
17
+ with :
18
+ python-version-file : pyproject.toml
20
19
- run : echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
21
- - run : python -m build
22
- # Generate hashes used for provenance.
20
+ - run : uv build
23
21
- name : generate hash
24
22
id : hash
25
23
run : cd dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
26
- - uses : actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
24
+ - uses : actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
27
25
with :
28
- name : dist
29
26
path : ./dist
30
27
provenance :
31
28
needs : [build]
@@ -34,35 +31,33 @@ jobs:
34
31
id-token : write
35
32
contents : write
36
33
# Can't pin with hash due to how this workflow works.
37
- uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0 .0
34
+ uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1 .0
38
35
with :
39
36
base64-subjects : ${{ needs.build.outputs.hash }}
40
37
create-release :
41
- # Upload the sdist, wheels, and provenance to a GitHub release. They remain
42
- # available as build artifacts for a while as well.
43
38
needs : [provenance]
44
39
runs-on : ubuntu-latest
45
40
permissions :
46
41
contents : write
47
42
steps :
48
- - uses : actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
43
+ - uses : actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
49
44
- name : create release
50
45
run : >
51
46
gh release create --draft --repo ${{ github.repository }}
52
47
${{ github.ref_name }}
53
- *.intoto.jsonl/* dist /*
48
+ *.intoto.jsonl/* artifact /*
54
49
env :
55
50
GH_TOKEN : ${{ github.token }}
56
51
publish-pypi :
57
52
needs : [provenance]
58
- # Wait for approval before attempting to upload to PyPI. This allows reviewing the
59
- # files in the draft release.
60
53
environment :
61
54
name : publish
62
- url : https://pypi.org/project/flask-orjson/
55
+ url : https://pypi.org/project/flask-orjson/${{ github.ref_name }}
63
56
runs-on : ubuntu-latest
64
57
permissions :
65
58
id-token : write
66
59
steps :
67
- - uses : actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
68
- - uses : pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # v1.9.0
60
+ - uses : actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
61
+ - uses : pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
62
+ with :
63
+ packages-dir : artifact/
0 commit comments