Skip to content

Commit 204abfc

Browse files
mykola-pereymamykola-pereyma
authored
Merge pull request #389 from mykola-pereyma/feat/release-attestations
[CHORE] Add build provenance attestations and checksums to release workflows
2 parents 041dcec + dfa5288 commit 204abfc

3 files changed

Lines changed: 79 additions & 19 deletions

File tree

‎.github/workflows/byokg-rag-prerelease.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88

99
permissions:
1010
contents: write
11+
attestations: write
12+
id-token: write
1113

1214
jobs:
1315
pre-release-build:
@@ -93,6 +95,21 @@ jobs:
9395
examples/byokg-rag/byokg-notebooks-latest.zip
9496
retention-days: 30
9597

98+
- name: Generate checksums
99+
working-directory: ${{ github.workspace }}
100+
run: |
101+
cd byokg-rag/dist && sha256sum *.whl *.tar.gz > SHA256SUMS && cd ${{ github.workspace }}
102+
sha256sum examples/byokg-rag/byokg-notebooks-${{ steps.version.outputs.version }}.zip | sed 's|.*/||' >> byokg-rag/dist/SHA256SUMS
103+
104+
- name: Attest build provenance
105+
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
106+
with:
107+
subject-path: |
108+
byokg-rag/dist/*.whl
109+
byokg-rag/dist/*.tar.gz
110+
byokg-rag/dist/SHA256SUMS
111+
examples/byokg-rag/byokg-notebooks-${{ steps.version.outputs.version }}.zip
112+
96113
- name: Attach artifacts to GitHub Pre-Release
97114
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
98115
with:

‎.github/workflows/byokg-rag-release.yml‎

Lines changed: 39 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ jobs:
1616
version: ${{ steps.version.outputs.pypi_version }}
1717
permissions:
1818
contents: write
19+
attestations: write
20+
id-token: write
1921

2022
defaults:
2123
run:
@@ -95,6 +97,21 @@ jobs:
9597
examples/byokg-rag/byokg-notebooks-latest.zip
9698
retention-days: 30
9799

100+
- name: Generate checksums
101+
working-directory: ${{ github.workspace }}
102+
run: |
103+
cd byokg-rag/dist && sha256sum *.whl *.tar.gz > SHA256SUMS && cd ${{ github.workspace }}
104+
sha256sum examples/byokg-rag/byokg-notebooks-${{ steps.version.outputs.version }}.zip | sed 's|.*/||' >> byokg-rag/dist/SHA256SUMS
105+
106+
- name: Attest build provenance
107+
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
108+
with:
109+
subject-path: |
110+
byokg-rag/dist/*.whl
111+
byokg-rag/dist/*.tar.gz
112+
byokg-rag/dist/SHA256SUMS
113+
examples/byokg-rag/byokg-notebooks-${{ steps.version.outputs.version }}.zip
114+
98115
- name: Attach artifacts to GitHub Release
99116
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
100117
with:
@@ -104,21 +121,25 @@ jobs:
104121
examples/byokg-rag/byokg-notebooks-latest.zip
105122
prerelease: false
106123

107-
# pypi-publish:
108-
# runs-on: ubuntu-latest
109-
# needs: release-build
110-
# permissions:
111-
# id-token: write
112-
# environment:
113-
# name: pypi
114-
# url: https://pypi.org/project/graphrag-byokg/${{ needs.release-build.outputs.version }}
115-
# steps:
116-
# - name: Download build artifacts
117-
# uses: actions/download-artifact@v4
118-
# with:
119-
# name: byokg-rag-dist
120-
# path: dist/
121-
# - name: Remove non-versioned dist copies
122-
# run: rm -f dist/*-latest.*
123-
# - name: Publish to PyPI
124-
# uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
124+
pypi-publish:
125+
if: github.event.action == 'released'
126+
runs-on: ubuntu-latest
127+
needs: release-build
128+
permissions:
129+
id-token: write
130+
attestations: write
131+
environment:
132+
name: pypi
133+
url: https://pypi.org/project/graphrag-byokg/${{ needs.release-build.outputs.version }}
134+
steps:
135+
- name: Download build artifacts
136+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
137+
with:
138+
name: byokg-rag-dist
139+
path: dist/
140+
- name: Remove non-versioned dist copies
141+
run: rm -f dist/*-latest.*
142+
- name: Publish to PyPI
143+
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
144+
with:
145+
attestations: true

‎.github/workflows/lexical-graph-release.yml‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ on:
1616

1717
permissions:
1818
contents: write
19+
attestations: write
20+
id-token: write
1921

2022
jobs:
2123
release-build:
@@ -120,6 +122,23 @@ jobs:
120122
done
121123
done
122124
125+
- name: Generate checksums
126+
working-directory: ${{ github.workspace }}
127+
run: |
128+
cd lexical-graph/dist && sha256sum *.whl *.tar.gz > SHA256SUMS && cd ${{ github.workspace }}
129+
sha256sum examples/lexical-graph/notebooks/lexical-graph-examples-${{ steps.version.outputs.version }}.zip | sed 's|.*/||' >> lexical-graph/dist/SHA256SUMS
130+
sha256sum examples/lexical-graph-hybrid-dev/notebooks/lexical-graph-hybrid-dev-examples-${{ steps.version.outputs.version }}.zip | sed 's|.*/||' >> lexical-graph/dist/SHA256SUMS
131+
132+
- name: Attest build provenance
133+
uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
134+
with:
135+
subject-path: |
136+
lexical-graph/dist/*.whl
137+
lexical-graph/dist/*.tar.gz
138+
lexical-graph/dist/SHA256SUMS
139+
examples/lexical-graph/notebooks/lexical-graph-examples-${{ steps.version.outputs.version }}.zip
140+
examples/lexical-graph-hybrid-dev/notebooks/lexical-graph-hybrid-dev-examples-${{ steps.version.outputs.version }}.zip
141+
123142
- name: Attach Artifacts to GitHub Release
124143
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
125144
with:
@@ -137,16 +156,19 @@ jobs:
137156
needs: release-build
138157
permissions:
139158
id-token: write
159+
attestations: write
140160
environment:
141161
name: pypi
142162
url: https://pypi.org/project/graphrag-lexical-graph/${{ needs.release-build.outputs.version }}
143163
steps:
144164
- name: Download build artifacts
145-
uses: actions/download-artifact@v8
165+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
146166
with:
147167
name: lexical-graph-dist
148168
path: dist/
149169
- name: Remove non-versioned dist copies
150170
run: rm -f dist/*-latest.*
151171
- name: Publish to PyPI
152172
uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
173+
with:
174+
attestations: true

0 commit comments

Comments
 (0)