build-publish.yml

name: Build and publish

on:
  workflow_dispatch:
  push:
    tags:
      - 'v*.*.*'
    branches:
      - trunk

permissions:  # added using https://github.com/step-security/secure-repo
  contents: read

jobs:
  build:
    name: Build package
    runs-on: ubuntu-latest
    steps:
    - name: Checkout this repo
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Set up Python
      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
      with:
          python-version: '3.14'
    - name: Install Poetry
      uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4.0.0
      with:
        poetry-version: '2.2.1'
    # The dark mode and light mode Atsign logos in the GitHub README don't
    # show properly on PyPI so we have a copy of the README.md in
    # README.PyPI.md with just the light mode logo.
    # That README is generated here from a stub header line plus the rest
    # of the main README.md
    - name: Generate README for PyPI
      run: |
        mv README.PyPI.md.stub README.PyPI.md
        tail -n +2 README.md >> README.PyPI.md
    - name: Build using Poetry
      run: |
        poetry build
    - name: Store the distribution packages
      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
      with:
        name: python-package-distributions
        path: dist/

  publish-to-testpypi:
    name: Publish package to TestPyPI
    needs:
    - build
    runs-on: ubuntu-latest
    environment:
      name: testpypi
      url: https://test.pypi.org/p/atsdk
    permissions:
      id-token: write  # IMPORTANT: mandatory for trusted publishing
    steps:
    - name: Download all the dists
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: python-package-distributions
        path: dist/
    - name: Publish distribution to TestPyPI
      uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
      with:
        skip-existing: true
        attestations: true
        repository-url: https://test.pypi.org/legacy/

  publish-to-pypi:
    name: Publish package to PyPI
    if: startsWith(github.ref, 'refs/tags/v')  # only publish to PyPI on tag pushes
    needs:
    - build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/p/atsdk
    permissions:
      id-token: write  # IMPORTANT: mandatory for trusted publishing
    steps:
    - name: Download all the dists
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: python-package-distributions
        path: dist/
    - name: Publish distribution to PyPI
      uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
      with:
        skip-existing: true
        attestations: true

  github-release:
    name: Attest Python distribution artifacts and upload them to the GitHub Release
    needs:
    - publish-to-pypi
    runs-on: ubuntu-latest
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    permissions:
      contents: write  # IMPORTANT: mandatory for making GitHub Releases
      id-token: write  # IMPORTANT: mandatory for sigstore
      attestations: write
    steps:
    - name: Checkout poetry.lock and pyproject.toml
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      with:
        sparse-checkout: |
          poetry.lock
          pyproject.toml
        sparse-checkout-cone-mode: false
    - name: Download all the dists
      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
      with:
        name: python-package-distributions
        path: dist/
    - name: Generate SBOM
      uses: sbomify/github-action@ddf6a0d3d75b645153ad1ad60034b3fe2cb1eb63 # v26.7.0
      env:
        TOKEN: ${{ secrets.SBOMIFY_TOKEN }}
        COMPONENT_ID: 'wy8Kpn8rF9'
        LOCK_FILE: './poetry.lock'
        COMPONENT_VERSION: ${{github.ref_name}}-gha${{github.run_number}}
        OUTPUT_FILE: 'dist/at_python-${{github.ref_name}}-sbom.cdx.json'
        AUGMENT: true
        ENRICH: true
        UPLOAD: true
    - name: Generate SHA256 checksums
      working-directory: dist
      run: sha256sum * > checksums.txt
    - id: hash
      name: Pass artifact hashes for SLSA provenance
      working-directory: dist
      run: |
        echo "hashes=$(cat checksums.txt | base64 -w0)" >> "$GITHUB_OUTPUT"
    - name: Attest the release artifacts
      uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
      with:
        subject-path: 'dist/**'
    - name: Upload artifact signatures to GitHub Release
      env:
        GITHUB_TOKEN: ${{ github.token }}
      # Upload to GitHub Release using the `gh` CLI.
      # `dist/` contains the built packages
      run: >-
        gh release upload
        '${{ github.ref_name }}' dist/**
        --repo '${{ github.repository }}'

  provenance:
    needs: [github-release]
    permissions:
      actions: read # Needed for detection of GitHub Actions environment.
      id-token: write # Needed for provenance signing and ID
      contents: write # Needed for release uploads
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 # 5a775b367a56d5bd118a224a811bba288150a563
    with:
      base64-subjects: "${{ needs.github-release.outputs.hashes }}"
      upload-assets: true