Bump boto3 from 1.43.36 to 1.43.56 (#829) #101
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [v2, v3] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| run-checks: | |
| uses: ./.github/workflows/checks.yml | |
| package-validation: | |
| name: Package and Release Validation | |
| runs-on: ubuntu-latest | |
| needs: run-checks | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 | |
| id: octo-sts | |
| with: | |
| scope: DataDog/guarddog | |
| policy: self.github.tag-release.${{ github.ref_name }} | |
| - name: Checkout | |
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ steps.octo-sts.outputs.token }} | |
| - name: 'Set up Python 3.10' | |
| uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 | |
| with: | |
| python-version: "3.10" | |
| cache: 'pip' | |
| - name: Set up SCFW_HOME | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.scfw | |
| key: scfw-${{ runner.os }}-3.10-${{ hashFiles('.github/workflows/tag-release.yml') }} | |
| - name: Set up Supply Chain Firewall | |
| uses: DataDog/supply-chain-firewall-action@2f166ae1d2c34ed717d7b08427c7acb57804f3f5 # v1.0.0 | |
| with: | |
| on-warning: ALLOW | |
| scfw-home: ~/.scfw | |
| - name: Install poetry | |
| run: pip install -r .github/workflows/requirements.txt | |
| - name: Check if version was bumped | |
| id: version-check | |
| run: | | |
| # Get current version from pyproject.toml using Poetry | |
| CURRENT_VERSION=$(poetry version -s) | |
| echo "Current version: $CURRENT_VERSION" | |
| # Get previous version by checking out HEAD~1 temporarily | |
| git stash --quiet | |
| git checkout --quiet HEAD~1 | |
| PREVIOUS_VERSION=$(poetry version -s 2>/dev/null || echo "0.0.0") | |
| git checkout --quiet - | |
| git stash pop --quiet 2>/dev/null || true | |
| echo "Previous version: $PREVIOUS_VERSION" | |
| # Compare versions | |
| if [ "$CURRENT_VERSION" != "$PREVIOUS_VERSION" ]; then | |
| echo "Version was bumped from $PREVIOUS_VERSION to $CURRENT_VERSION" | |
| echo "version_bumped=true" >> $GITHUB_OUTPUT | |
| echo "new_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT | |
| echo "previous_version=$PREVIOUS_VERSION" >> $GITHUB_OUTPUT | |
| else | |
| echo "::warning::Version was not bumped in pyproject.toml (still $CURRENT_VERSION). Skipping release process." | |
| echo "version_bumped=false" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| - name: Create Git tag | |
| if: steps.version-check.outputs.version_bumped == 'true' | |
| run: | | |
| git config --local user.email "action@github.com" | |
| git config --local user.name "GitHub Action" | |
| git tag "v${{ steps.version-check.outputs.new_version }}" | |
| git push --tags | |
| - name: Create GitHub Release | |
| id: create-release | |
| if: steps.version-check.outputs.version_bumped == 'true' | |
| env: | |
| GH_TOKEN: ${{ steps.octo-sts.outputs.token }} | |
| run: | | |
| gh release create "v${{ steps.version-check.outputs.new_version }}" \ | |
| --title "Release v${{ steps.version-check.outputs.new_version }}" \ | |
| --generate-notes | |
| outputs: | |
| version_bumped: ${{ steps.version-check.outputs.version_bumped }} | |
| new_version: ${{ steps.version-check.outputs.new_version }} | |
| pypi-publish: | |
| name: Build and Publish to PyPI | |
| runs-on: ubuntu-latest | |
| needs: package-validation | |
| if: needs.package-validation.outputs.version_bumped == 'true' | |
| environment: protected-main-env | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: 'Set up Python 3.10' | |
| uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0 | |
| with: | |
| python-version: "3.10" | |
| - name: Set up SCFW_HOME | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.scfw | |
| key: scfw-${{ runner.os }}-3.10-${{ hashFiles('.github/workflows/tag-release.yml') }} | |
| - name: Set up Supply Chain Firewall | |
| uses: DataDog/supply-chain-firewall-action@2f166ae1d2c34ed717d7b08427c7acb57804f3f5 # v1.0.0 | |
| with: | |
| on-warning: ALLOW | |
| scfw-home: ~/.scfw | |
| - name: Install poetry | |
| run: pip install -r .github/workflows/requirements.txt | |
| - name: Build | |
| run: | | |
| poetry version $(git describe --tags --abbrev=0) | |
| poetry build | |
| - name: Publish distribution 📦 to PyPI | |
| uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0 | |
| docker-publish: | |
| name: Build and Push Docker Image | |
| runs-on: ubuntu-latest | |
| needs: package-validation | |
| if: needs.package-validation.outputs.version_bumped == 'true' | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: datadog/guarddog | |
| steps: | |
| - uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0 | |
| with: | |
| egress-policy: audit | |
| - name: Log into registry ${{ env.REGISTRY }} | |
| uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0 | |
| with: | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| build-args: | | |
| VERSION=${{ needs.package-validation.outputs.new_version }} | |
| tags: | | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.package-validation.outputs.new_version }} | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref_name }} | |
| ${{ github.ref_name == 'v3' && format('{0}/{1}:latest', env.REGISTRY, env.IMAGE_NAME) || '' }} |