Skip to content

Commit 4e3f86f

Browse files
tdyastdyas
authored
add GitHub artifact attestations for releases (#21953)
Add GitHub release attestations using the https://github.com/actions/attest-build-provenance/ action.
1 parent 5af291d commit 4e3f86f

File tree

3 files changed

+166
-18
lines changed

3 files changed

+166
-18
lines changed

‎.github/workflows/release.yaml

Lines changed: 106 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ jobs:
1515
name: Build wheels (Linux-ARM64)
1616
needs:
1717
- release_info
18+
permissions:
19+
attestations: write
20+
contents: read
21+
id-token: write
1822
runs-on:
1923
- self-hosted
2024
- runs-on
@@ -73,17 +77,34 @@ jobs:
7377
name: logs-wheels-and-pex-Linux-ARM64
7478
overwrite: 'true'
7579
path: .pants.d/workdir/*.log
80+
- if: needs.release_info.outputs.is-release == 'true'
81+
name: Attest the pantsbuild.pants wheel
82+
uses: actions/attest-build-provenance@v2
83+
with:
84+
subject-path: dist/deploy/wheels/pantsbuild.pants/**/pantsbuild.pants-*.whl
85+
- if: needs.release_info.outputs.is-release == 'true'
86+
name: Rename the Pants Pex to its final name for upload
87+
run: 'PEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex
88+
89+
mv dist/src.python.pants/pants-pex.pex dist/src.python.pants/$PEX_FILENAME
90+
91+
'
92+
- continue-on-error: true
93+
if: needs.release_info.outputs.is-release == 'true'
94+
name: Attest the Pants Pex artifact
95+
uses: actions/attest-build-provenance@v2
96+
with:
97+
subject-path: dist/src.python.pants/*.pex
7698
- if: needs.release_info.outputs.is-release == 'true'
7799
name: Upload Wheel and Pex
78100
run: "PANTS_VER=$(PEX_INTERPRETER=1 dist/src.python.pants/pants-pex.pex -c \"\
79101
import pants.version;print(pants.version.VERSION)\")\nPY_VER=$(PEX_INTERPRETER=1\
80102
\ dist/src.python.pants/pants-pex.pex -c \"import sys;print(f'cp{sys.version_info[0]}{sys.version_info[1]}')\"\
81103
)\nPLAT=$(PEX_INTERPRETER=1 dist/src.python.pants/pants-pex.pex -c \"import\
82104
\ os;print(f'{os.uname().sysname.lower()}_{os.uname().machine.lower()}')\"\
83-
)\nPEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex\n\nmv dist/src.python.pants/pants-pex.pex\
84-
\ dist/src.python.pants/$PEX_FILENAME\n\ncurl -L --fail \\\n -X POST \\\
85-
\n -H \"Authorization: Bearer ${{ github.token }}\" \\\n -H \"Content-Type:\
86-
\ application/octet-stream\" \\\n ${{ needs.release_info.outputs.release-asset-upload-url\
105+
)\nPEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex\n\ncurl -L --fail \\\n\
106+
\ -X POST \\\n -H \"Authorization: Bearer ${{ github.token }}\" \\\n\
107+
\ -H \"Content-Type: application/octet-stream\" \\\n ${{ needs.release_info.outputs.release-asset-upload-url\
87108
\ }}?name=$PEX_FILENAME \\\n --data-binary \"@dist/src.python.pants/$PEX_FILENAME\"\
88109
\n\nWHL=$(find dist/deploy/wheels/pantsbuild.pants -type f -name \"pantsbuild.pants-*.whl\"\
89110
)\ncurl -L --fail \\\n -X POST \\\n -H \"Authorization: Bearer ${{ github.token\
@@ -102,6 +123,10 @@ jobs:
102123
name: Build wheels (Linux-x86_64)
103124
needs:
104125
- release_info
126+
permissions:
127+
attestations: write
128+
contents: read
129+
id-token: write
105130
runs-on:
106131
- ubuntu-22.04
107132
steps:
@@ -160,23 +185,46 @@ jobs:
160185
name: logs-wheels-and-pex-Linux-x86_64
161186
overwrite: 'true'
162187
path: .pants.d/workdir/*.log
188+
- if: needs.release_info.outputs.is-release == 'true'
189+
name: Attest the pantsbuild.pants wheel
190+
uses: actions/attest-build-provenance@v2
191+
with:
192+
subject-path: dist/deploy/wheels/pantsbuild.pants/**/pantsbuild.pants-*.whl
193+
- if: needs.release_info.outputs.is-release == 'true'
194+
name: Rename the Pants Pex to its final name for upload
195+
run: 'PEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex
196+
197+
mv dist/src.python.pants/pants-pex.pex dist/src.python.pants/$PEX_FILENAME
198+
199+
'
200+
- continue-on-error: true
201+
if: needs.release_info.outputs.is-release == 'true'
202+
name: Attest the Pants Pex artifact
203+
uses: actions/attest-build-provenance@v2
204+
with:
205+
subject-path: dist/src.python.pants/*.pex
163206
- if: needs.release_info.outputs.is-release == 'true'
164207
name: Upload Wheel and Pex
165208
run: "PANTS_VER=$(PEX_INTERPRETER=1 dist/src.python.pants/pants-pex.pex -c \"\
166209
import pants.version;print(pants.version.VERSION)\")\nPY_VER=$(PEX_INTERPRETER=1\
167210
\ dist/src.python.pants/pants-pex.pex -c \"import sys;print(f'cp{sys.version_info[0]}{sys.version_info[1]}')\"\
168211
)\nPLAT=$(PEX_INTERPRETER=1 dist/src.python.pants/pants-pex.pex -c \"import\
169212
\ os;print(f'{os.uname().sysname.lower()}_{os.uname().machine.lower()}')\"\
170-
)\nPEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex\n\nmv dist/src.python.pants/pants-pex.pex\
171-
\ dist/src.python.pants/$PEX_FILENAME\n\ncurl -L --fail \\\n -X POST \\\
172-
\n -H \"Authorization: Bearer ${{ github.token }}\" \\\n -H \"Content-Type:\
173-
\ application/octet-stream\" \\\n ${{ needs.release_info.outputs.release-asset-upload-url\
213+
)\nPEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex\n\ncurl -L --fail \\\n\
214+
\ -X POST \\\n -H \"Authorization: Bearer ${{ github.token }}\" \\\n\
215+
\ -H \"Content-Type: application/octet-stream\" \\\n ${{ needs.release_info.outputs.release-asset-upload-url\
174216
\ }}?name=$PEX_FILENAME \\\n --data-binary \"@dist/src.python.pants/$PEX_FILENAME\"\
175217
\n\nWHL=$(find dist/deploy/wheels/pantsbuild.pants -type f -name \"pantsbuild.pants-*.whl\"\
176218
)\ncurl -L --fail \\\n -X POST \\\n -H \"Authorization: Bearer ${{ github.token\
177219
\ }}\" \\\n -H \"Content-Type: application/octet-stream\" \\\n \"${{\
178220
\ needs.release_info.outputs.release-asset-upload-url }}?name=$(basename $WHL)\"\
179221
\ \\\n --data-binary \"@$WHL\";\n"
222+
- continue-on-error: true
223+
if: needs.release_info.outputs.is-release == 'true'
224+
name: Attest the pantsbuild.pants.testutil wheel
225+
uses: actions/attest-build-provenance@v2
226+
with:
227+
subject-path: dist/deploy/wheels/pantsbuild.pants/**/pantsbuild.pants.testutil*.whl
180228
- if: needs.release_info.outputs.is-release == 'true'
181229
name: Upload testutil Wheel
182230
run: "WHL=$(find dist/deploy/wheels/pantsbuild.pants -type f -name \"pantsbuild.pants.testutil*.whl\"\
@@ -194,6 +242,10 @@ jobs:
194242
name: Build wheels (macOS13-x86_64)
195243
needs:
196244
- release_info
245+
permissions:
246+
attestations: write
247+
contents: read
248+
id-token: write
197249
runs-on:
198250
- macos-13
199251
steps:
@@ -270,17 +322,34 @@ jobs:
270322
name: logs-wheels-and-pex-macOS13-x86_64
271323
overwrite: 'true'
272324
path: .pants.d/workdir/*.log
325+
- if: needs.release_info.outputs.is-release == 'true'
326+
name: Attest the pantsbuild.pants wheel
327+
uses: actions/attest-build-provenance@v2
328+
with:
329+
subject-path: dist/deploy/wheels/pantsbuild.pants/**/pantsbuild.pants-*.whl
330+
- if: needs.release_info.outputs.is-release == 'true'
331+
name: Rename the Pants Pex to its final name for upload
332+
run: 'PEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex
333+
334+
mv dist/src.python.pants/pants-pex.pex dist/src.python.pants/$PEX_FILENAME
335+
336+
'
337+
- continue-on-error: true
338+
if: needs.release_info.outputs.is-release == 'true'
339+
name: Attest the Pants Pex artifact
340+
uses: actions/attest-build-provenance@v2
341+
with:
342+
subject-path: dist/src.python.pants/*.pex
273343
- if: needs.release_info.outputs.is-release == 'true'
274344
name: Upload Wheel and Pex
275345
run: "PANTS_VER=$(PEX_INTERPRETER=1 dist/src.python.pants/pants-pex.pex -c \"\
276346
import pants.version;print(pants.version.VERSION)\")\nPY_VER=$(PEX_INTERPRETER=1\
277347
\ dist/src.python.pants/pants-pex.pex -c \"import sys;print(f'cp{sys.version_info[0]}{sys.version_info[1]}')\"\
278348
)\nPLAT=$(PEX_INTERPRETER=1 dist/src.python.pants/pants-pex.pex -c \"import\
279349
\ os;print(f'{os.uname().sysname.lower()}_{os.uname().machine.lower()}')\"\
280-
)\nPEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex\n\nmv dist/src.python.pants/pants-pex.pex\
281-
\ dist/src.python.pants/$PEX_FILENAME\n\ncurl -L --fail \\\n -X POST \\\
282-
\n -H \"Authorization: Bearer ${{ github.token }}\" \\\n -H \"Content-Type:\
283-
\ application/octet-stream\" \\\n ${{ needs.release_info.outputs.release-asset-upload-url\
350+
)\nPEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex\n\ncurl -L --fail \\\n\
351+
\ -X POST \\\n -H \"Authorization: Bearer ${{ github.token }}\" \\\n\
352+
\ -H \"Content-Type: application/octet-stream\" \\\n ${{ needs.release_info.outputs.release-asset-upload-url\
284353
\ }}?name=$PEX_FILENAME \\\n --data-binary \"@dist/src.python.pants/$PEX_FILENAME\"\
285354
\n\nWHL=$(find dist/deploy/wheels/pantsbuild.pants -type f -name \"pantsbuild.pants-*.whl\"\
286355
)\ncurl -L --fail \\\n -X POST \\\n -H \"Authorization: Bearer ${{ github.token\
@@ -297,6 +366,10 @@ jobs:
297366
name: Build wheels (macOS14-ARM64)
298367
needs:
299368
- release_info
369+
permissions:
370+
attestations: write
371+
contents: read
372+
id-token: write
300373
runs-on:
301374
- macos-14
302375
steps:
@@ -369,17 +442,34 @@ jobs:
369442
name: logs-wheels-and-pex-macOS14-ARM64
370443
overwrite: 'true'
371444
path: .pants.d/workdir/*.log
445+
- if: needs.release_info.outputs.is-release == 'true'
446+
name: Attest the pantsbuild.pants wheel
447+
uses: actions/attest-build-provenance@v2
448+
with:
449+
subject-path: dist/deploy/wheels/pantsbuild.pants/**/pantsbuild.pants-*.whl
450+
- if: needs.release_info.outputs.is-release == 'true'
451+
name: Rename the Pants Pex to its final name for upload
452+
run: 'PEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex
453+
454+
mv dist/src.python.pants/pants-pex.pex dist/src.python.pants/$PEX_FILENAME
455+
456+
'
457+
- continue-on-error: true
458+
if: needs.release_info.outputs.is-release == 'true'
459+
name: Attest the Pants Pex artifact
460+
uses: actions/attest-build-provenance@v2
461+
with:
462+
subject-path: dist/src.python.pants/*.pex
372463
- if: needs.release_info.outputs.is-release == 'true'
373464
name: Upload Wheel and Pex
374465
run: "PANTS_VER=$(PEX_INTERPRETER=1 dist/src.python.pants/pants-pex.pex -c \"\
375466
import pants.version;print(pants.version.VERSION)\")\nPY_VER=$(PEX_INTERPRETER=1\
376467
\ dist/src.python.pants/pants-pex.pex -c \"import sys;print(f'cp{sys.version_info[0]}{sys.version_info[1]}')\"\
377468
)\nPLAT=$(PEX_INTERPRETER=1 dist/src.python.pants/pants-pex.pex -c \"import\
378469
\ os;print(f'{os.uname().sysname.lower()}_{os.uname().machine.lower()}')\"\
379-
)\nPEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex\n\nmv dist/src.python.pants/pants-pex.pex\
380-
\ dist/src.python.pants/$PEX_FILENAME\n\ncurl -L --fail \\\n -X POST \\\
381-
\n -H \"Authorization: Bearer ${{ github.token }}\" \\\n -H \"Content-Type:\
382-
\ application/octet-stream\" \\\n ${{ needs.release_info.outputs.release-asset-upload-url\
470+
)\nPEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex\n\ncurl -L --fail \\\n\
471+
\ -X POST \\\n -H \"Authorization: Bearer ${{ github.token }}\" \\\n\
472+
\ -H \"Content-Type: application/octet-stream\" \\\n ${{ needs.release_info.outputs.release-asset-upload-url\
383473
\ }}?name=$PEX_FILENAME \\\n --data-binary \"@dist/src.python.pants/$PEX_FILENAME\"\
384474
\n\nWHL=$(find dist/deploy/wheels/pantsbuild.pants -type f -name \"pantsbuild.pants-*.whl\"\
385475
)\ncurl -L --fail \\\n -X POST \\\n -H \"Authorization: Bearer ${{ github.token\

‎.github/workflows/test.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -336,6 +336,10 @@ jobs:
336336
name: Build wheels (Linux-ARM64)
337337
needs:
338338
- classify_changes
339+
permissions:
340+
attestations: write
341+
contents: read
342+
id-token: write
339343
runs-on:
340344
- self-hosted
341345
- runs-on
@@ -406,6 +410,10 @@ jobs:
406410
name: Build wheels (Linux-x86_64)
407411
needs:
408412
- classify_changes
413+
permissions:
414+
attestations: write
415+
contents: read
416+
id-token: write
409417
runs-on:
410418
- ubuntu-22.04
411419
steps:
@@ -474,6 +482,10 @@ jobs:
474482
name: Build wheels (macOS13-x86_64)
475483
needs:
476484
- classify_changes
485+
permissions:
486+
attestations: write
487+
contents: read
488+
id-token: write
477489
runs-on:
478490
- macos-13
479491
steps:
@@ -560,6 +572,10 @@ jobs:
560572
name: Build wheels (macOS14-ARM64)
561573
needs:
562574
- classify_changes
575+
permissions:
576+
attestations: write
577+
contents: read
578+
id-token: write
563579
runs-on:
564580
- macos-14
565581
steps:

‎src/python/pants_release/generate_github_workflows.py

Lines changed: 44 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
def action(name: str) -> str:
2222
version_map = {
2323
"action-send-mail": "dawidd6/[email protected]",
24+
"attest-build-provenance": "actions/attest-build-provenance@v2",
2425
"cache": "actions/cache@v4",
2526
"checkout": "actions/checkout@v4",
2627
"download-artifact": "actions/download-artifact@v4",
@@ -880,6 +881,11 @@ def build_wheels_job(
880881
"if": if_condition,
881882
"name": f"Build wheels ({str(platform.value)})",
882883
"runs-on": helper.runs_on(),
884+
"permissions": {
885+
"id-token": "write",
886+
"contents": "read",
887+
"attestations": "write",
888+
},
883889
**({"container": container} if container else {}),
884890
**({"needs": needs} if needs else {}),
885891
"timeout-minutes": 90,
@@ -913,6 +919,34 @@ def build_wheels_job(
913919
helper.upload_log_artifacts(name="wheels-and-pex"),
914920
*(
915921
[
922+
{
923+
"name": "Attest the pantsbuild.pants wheel",
924+
"if": "needs.release_info.outputs.is-release == 'true'",
925+
"uses": action("attest-build-provenance"),
926+
"with": {
927+
"subject-path": "dist/deploy/wheels/pantsbuild.pants/**/pantsbuild.pants-*.whl",
928+
},
929+
},
930+
{
931+
"name": "Rename the Pants Pex to its final name for upload",
932+
"if": "needs.release_info.outputs.is-release == 'true'",
933+
"run": dedent(
934+
"""\
935+
PEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex
936+
mv dist/src.python.pants/pants-pex.pex dist/src.python.pants/$PEX_FILENAME
937+
"""
938+
),
939+
},
940+
{
941+
"name": "Attest the Pants Pex artifact",
942+
"if": "needs.release_info.outputs.is-release == 'true'",
943+
"uses": action("attest-build-provenance"),
944+
"with": {
945+
"subject-path": "dist/src.python.pants/*.pex",
946+
},
947+
# Temporary: Allow errors in this step while we test the release workflow.
948+
"continue-on-error": True,
949+
},
916950
{
917951
"name": "Upload Wheel and Pex",
918952
"if": "needs.release_info.outputs.is-release == 'true'",
@@ -927,8 +961,6 @@ def build_wheels_job(
927961
PLAT=$(PEX_INTERPRETER=1 dist/src.python.pants/pants-pex.pex -c "import os;print(f'{os.uname().sysname.lower()}_{os.uname().machine.lower()}')")
928962
PEX_FILENAME=pants.$PANTS_VER-$PY_VER-$PLAT.pex
929963
930-
mv dist/src.python.pants/pants-pex.pex dist/src.python.pants/$PEX_FILENAME
931-
932964
curl -L --fail \\
933965
-X POST \\
934966
-H "Authorization: Bearer ${{ github.token }}" \\
@@ -948,6 +980,16 @@ def build_wheels_job(
948980
},
949981
*(
950982
[
983+
{
984+
"name": "Attest the pantsbuild.pants.testutil wheel",
985+
"if": "needs.release_info.outputs.is-release == 'true'",
986+
"uses": action("attest-build-provenance"),
987+
"with": {
988+
"subject-path": "dist/deploy/wheels/pantsbuild.pants/**/pantsbuild.pants.testutil*.whl",
989+
},
990+
# Temporary: Allow errors in this step while we test the release workflow.
991+
"continue-on-error": True,
992+
},
951993
{
952994
"name": "Upload testutil Wheel",
953995
"if": "needs.release_info.outputs.is-release == 'true'",

0 commit comments

Comments
 (0)