From 2812a61ed51ac6553bf0d276681a3f98dbe4d686 Mon Sep 17 00:00:00 2001 From: Bruno Oliveira Date: Thu, 16 May 2024 08:08:45 -0300 Subject: [PATCH] Attest package provenance This uses the new build provenance support added in [build-and-inspect-python-package 2.5.0](https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md#250---2024-05-13). More information: https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/ Tested also in https://github.com/pytest-dev/pytest-mock/pull/431. Note: even though it is technically necessary only for the `deploy` workflow, as the `test` workflow does not publish its packages, decided to always attest the provenance in both cases to avoid any surprises related to this (say a misconfiguration) when deploying. --- .github/workflows/deploy.yml | 9 ++++++++- .github/workflows/test.yml | 8 +++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index cc0e6331d..c6357d408 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -18,6 +18,11 @@ jobs: env: SETUPTOOLS_SCM_PRETEND_VERSION: ${{ github.event.inputs.version }} timeout-minutes: 10 + + # Required by attest-build-provenance-github. + permissions: + id-token: write + attestations: write steps: - uses: actions/checkout@v4 @@ -26,7 +31,9 @@ jobs: persist-credentials: false - name: Build and Check Package - uses: hynek/build-and-inspect-python-package@v2.4.0 + uses: hynek/build-and-inspect-python-package@v2.5.0 + with: + attest-build-provenance-github: 'true' deploy: if: github.repository == 'pytest-dev/pytest' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 443474067..b294c1b4a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -29,13 +29,19 @@ permissions: {} jobs: package: runs-on: ubuntu-latest + # Required by attest-build-provenance-github. + permissions: + id-token: write + attestations: write steps: - uses: actions/checkout@v4 with: fetch-depth: 0 persist-credentials: false - name: Build and Check Package - uses: hynek/build-and-inspect-python-package@v2.4.0 + uses: hynek/build-and-inspect-python-package@v2.5.0 + with: + attest-build-provenance-github: 'true' build: needs: [package]